Skip to content
Fencer Vulns
critical 9.8

CVE-2020-24719 in the critical feed json

Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack.

published 2020-11-12 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-17430

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
23.3%
EPSS 23.3% chance of exploitation in 30 days, percentile 97%
public exploits
1
Metasploit

Summary

Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. Communication between Erlang nodes is done by exchanging a shared secret (aka "magic cookie"). There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlang node and run OS level commands on the system running the Erlang node. Affects version: 6.5.1. Fix version: 6.6.0.

Patch / fix

  • couchbase couchbase_server 6.6.0

Timeline

  1. First public exploit (Metasploit exploit/multi/misc/erlang_cookie_rce)
  2. Published

Exploit prediction

23.30% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.