CVE-2020-5849
Unraid Authentication Bypass Vulnerability
Description
CVE-2020-5849 is a high-severity authentication bypass vulnerability in Unraid version 6.8.0 that allows unauthenticated attackers to gain access to the administrative interface. This vulnerability is particularly dangerous because it can be chained with CVE-2020-5847, a remote code execution flaw, to achieve unauthenticated remote code execution as root on the affected system. CISA has confirmed active exploitation by listing this vulnerability in the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS score of 93.76% (99.9th percentile), this vulnerability has an extremely high probability of exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| unraid | unraid | 6.8.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- http://packetstormsecurity.com/files/157275/Unraid-6.8.0-Authentication-Bypass-Arbitrary-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://forums.unraid.net/forum/7-announcements/(Release Notes, Vendor Advisory)
- https://sysdream.com/news/lab/(Third Party Advisory)
- https://sysdream.com/news/lab/2020-02-06-cve-2020-5847-cve-2020-5849-unraid-6-8-0-unauthenticated-remote-code-execution-as-root/(Broken Link, Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-5849(US Government Resource)
Weakness Type
CWE-697: Incorrect Comparison
Incorrect Comparison occurs when software performs a comparison that is incorrect, leading to unexpected results and potentially allowing attackers to bypass security controls. In the context of CVE-2020-5849, the Unraid authentication mechanism contains an incorrect comparison flaw that allows attackers to bypass the authentication check entirely and gain unauthorized access to the administrative interface without providing valid credentials.
Learn more: CWE-697 — Incorrect Comparison
Impact Analysis
CVE-2020-5849 carries a CVSS 3.1 score of 7.5 (HIGH), reflecting a significant authentication bypass threat. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any remote attacker. Confidentiality (High): successful exploitation grants unauthorized access to the Unraid administrative interface, exposing server configuration, storage pools, Docker containers, virtual machines, and all managed data. Integrity (None) and Availability (None): while the CVSS score reflects only confidentiality impact for this specific CVE, the real-world threat is significantly amplified when combined with CVE-2020-5847, which enables arbitrary code execution as root. The EPSS score of 93.76% (99.9th percentile) indicates near-certain exploitation activity, making immediate remediation essential.
Exploit Maturity
Public exploit code is available for CVE-2020-5849 via Packet Storm Security, which includes both the authentication bypass and the chained remote code execution via CVE-2020-5847. CISA has confirmed active exploitation by including this vulnerability in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-05-03. The EPSS score of 93.76% (99.9th percentile) indicates near-certain exploitation activity across the internet. When combined with CVE-2020-5847, which provides arbitrary code execution, the attack chain enables unauthenticated remote code execution as root, making this a particularly high-priority threat for any exposed Unraid installation.
Remediation
- Apply vendor updates immediately as required by the CISA KEV directive: Apply updates per vendor instructions. Unraid has released patches in versions subsequent to 6.8.0 that address both CVE-2020-5849 and CVE-2020-5847.
- Upgrade all Unraid installations from version 6.8.0 to the latest available version that includes fixes for the authentication bypass. Verify the upgrade was successful by confirming the version number in the Unraid web interface.
- Immediately restrict network access to the Unraid web management interface, ensuring it is not exposed to the internet. Use firewall rules, VPN access requirements, or network segmentation to limit access to trusted administrator networks only.
- Monitor Unraid server logs for signs of unauthorized administrative access, unexpected user sessions, or anomalous API requests that may indicate exploitation of the authentication bypass.
- Audit all Unraid server configurations, Docker containers, VMs, and stored data for evidence of unauthorized modifications that may have occurred during the exposure window, particularly if the server was internet-accessible.
Technical Details
CVE-2020-5849 is rooted in an incorrect comparison vulnerability (CWE-697) within the Unraid 6.8.0 authentication mechanism. The flaw in the comparison logic allows an attacker to bypass the authentication check for the web-based administrative interface without providing valid credentials. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms that the attack is network-based, trivially simple to execute, requires no authentication or user interaction, and primarily impacts confidentiality by granting unauthorized access to the administrative panel. The vulnerability is particularly severe due to its chainability with CVE-2020-5847, a separate remote code execution vulnerability in the same Unraid version, which together form a complete attack chain from unauthenticated network access to root-level code execution on the NAS server.
Frequently Asked Questions
Is CVE-2020-5849 being actively exploited?
Yes. CVE-2020-5849 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 93.76% (99.9th percentile) indicates near-certain exploitation activity. Public exploit code is available that chains this vulnerability with CVE-2020-5847 for unauthenticated remote code execution. There is no known association with ransomware campaigns at this time.
What products are affected by CVE-2020-5849?
CVE-2020-5849 affects Unraid version 6.8.0. Unraid is a popular NAS (Network Attached Storage) operating system used for home and small business storage servers, Docker containers, and virtual machine hosting.
How do I fix CVE-2020-5849?
Upgrade Unraid from version 6.8.0 to the latest available version that includes the authentication bypass fix. Until the upgrade is applied, ensure the Unraid web interface is not accessible from the internet by placing it behind a firewall or VPN.
How severe is CVE-2020-5849?
CVE-2020-5849 has a CVSS 3.1 score of 7.5 (HIGH). While the standalone vulnerability impacts only confidentiality, it becomes critical when chained with CVE-2020-5847, enabling unauthenticated remote code execution as root. The EPSS score of 93.76% places it in the 99.9th percentile for exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.