Is CVE-2020-12641 actively exploited?

Yes. CVE-2020-12641 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2020-12641 be exploited remotely?

The attack vector of CVE-2020-12641 has not been classified yet.

What is the CVSS score of CVE-2020-12641?

CVE-2020-12641 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2020-12641

HIGHCISA KEVIN THE WILD

CVE-2020-12641

Published: June 22, 2023

EPSS:93.13%probability of exploitation in 30 daysPercentile:99.8th

Official Description

Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

NVD Source

CISA KEV Advisory

Roundcube Webmail Remote Code Execution Vulnerability

Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.

Added to KEV: 2023-06-22Federal patch deadline: 2023-07-13

Required Action (CISA)

Apply updates per vendor instructions.

Risk Analysis

This remote code execution vulnerability in Roundcube Webmail allows attackers to execute code by injecting shell metacharacters into specific configuration settings. The high EPSS score of 0.93133 indicates a strong likelihood of exploitation, and its presence in CISA's KEV confirms it is being actively exploited.

This vulnerability is actively exploited in the wild and is part of CISA's Known Exploited Vulnerabilities Catalog. Attackers are leveraging this flaw for remote code execution.

Recommended Action

Update Roundcube Webmail to a patched version. Review and sanitize configuration settings, particularly those related to external command paths, to prevent shell metacharacter injection.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2020-12641 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2020-12641 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.