openHAB exec add-ons allow remote arbitrary command execution
Priority MEDIUM 42CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file which cannot be changed via REST calls.
Why it matters now
EPSS 0.01973 80th percentileScored 2026-11-07
Fix Fixed openhab-addons (openhab): 2.5.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA openhab-addons (openhab) Fixed in 2.5.2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-5242
References
More Openhab vulnerabilities
- TI-2024-28437 CometVisu Backend for openHAB affected by RCE through path traversal CVSS 3.1CRITICAL 9.8
- TI-2024-28438 CometVisu Backend for openHAB has a sensitive information disclosure vulnerability CVSS 3.1CRITICAL 9.1
- TI-2024-28436 Path traversal (CometVisu) CVSS 3.1HIGH 7.5
- TI-2021-04367 XXE vulnerability in OpenHAB CVSS 3.1MEDIUM 6.4
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences