CVE-2020-14011
📋 TL;DR
CVE-2020-14011 is a critical vulnerability in Lansweeper that allows remote code execution via default admin credentials. Attackers can exploit the Add New Package and Scheduled Deployments features to execute arbitrary commands on affected systems. Organizations running Lansweeper 6.0.x through 7.2.x with default configurations are vulnerable.
💻 Affected Systems
- Lansweeper
📦 What is this software?
Lansweeper by Lansweeper
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands, deploy malware, steal sensitive data, and pivot to other network systems.
Likely Case
Unauthorized access leading to data exfiltration, installation of backdoors, or deployment of ransomware within the network.
If Mitigated
Limited impact with proper access controls, though default configuration still presents risk.
🎯 Exploit Status
Exploit requires default admin credentials but is trivial to execute with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.2.100.5 and later
Vendor Advisory: https://www.lansweeper.com/knowledgebase/restricting-access-to-the-web-console/
Restart Required: Yes
Instructions:
1. Update Lansweeper to version 7.2.100.5 or later. 2. Restart the Lansweeper service. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable Built-in Admin
windowsDisable the default admin account in Lansweeper configuration
Navigate to Lansweeper web console > Configuration > Security > Uncheck 'Built-in admin'
Restrict Web Console Access
allLimit access to Lansweeper web console to trusted IPs only
Configure firewall rules to restrict access to Lansweeper web port (typically 9524)
🧯 If You Can't Patch
- Disable the Built-in admin account immediately and use custom admin credentials
- Implement network segmentation to isolate Lansweeper server from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Lansweeper version via web console or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Lansweeper\VersionCheck Version:
reg query "HKLM\SOFTWARE\Lansweeper" /v VersionVerify Fix Applied:
Verify version is 7.2.100.5 or later and 'Built-in admin' is disabled in Security settings📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts to Lansweeper web console
- Execution of unexpected commands via package deployment features
Network Indicators:
- Unusual outbound connections from Lansweeper server
- Traffic to Lansweeper web port from unexpected sources
SIEM Query:
source="Lansweeper" AND (event="Authentication" AND user="admin") OR (event="PackageDeployment" AND command="*")🔗 References
- http://packetstormsecurity.com/files/158205/Lansweeper-7.2-Default-Account-Remote-Code-Execution.html
- https://pastebin.com/EUkMx94X
- https://www.lansweeper.com/knowledgebase/restricting-access-to-the-web-console/
- http://packetstormsecurity.com/files/158205/Lansweeper-7.2-Default-Account-Remote-Code-Execution.html
- https://pastebin.com/EUkMx94X
- https://www.lansweeper.com/knowledgebase/restricting-access-to-the-web-console/
