CVE-2020-7373

CVE-2020-7373, also tracked as the preferred CVE-2020-17496, is a critical remote command execution vulnerability affecting vBulletin versions 5.5.4 through 5.6.2. This flaw, stemming from an incomplete fix for a previous vulnerability (CVE-2019-16759), allows unauthenticated attackers to execute arbitrary commands by sending crafted data in a specific AJAX request. With a CVSS score of 9.8 (Critical), it presents a high risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation, public exploit code, or significant community discussion, its high EPSS score and FAUCET Risk Score indicate a substantial potential for future exploitation.