CVE-2020-15492: An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804

This week

CRITICAL 9.8REMOTEUPGRADE

CVE-2020-15492 is a critical-severity flaw (CVSS 9.8) affecting startup tools. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the server via Directory Traversal, or possibly have unspecified other impact.

Why this priority

Critical severity
EPSS top 3%: very likely to be exploited
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	16.6% (top 3%)
CISA exploited list	No
Weakness	CWE-22
Published	2020-07-23
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: inneo

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-07-23 20:15 UTCPublished CVE record published
2026-06-17 02:56 UTCUpdated Record last modified

inneo startup tools UPGRADE

Affected: >= 12.0.66.3784 and <= 13.0.70.3804

Fixed in: newer than 13.0.70.3804

Safe to downgrade to: a release before 12.0.66.3784

1. Check installed version

apt-cache policy startup-tools || rpm -q startup-tools || startup-tools --version

2. UPGRADE to newer than 13.0.70.3804 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade startup-tools

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade startup-tools

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 12.0.66.3784 (Debian / Ubuntu)

apt-cache madison startup-tools sudo apt install startup-tools=<VERSION_BEFORE_12.0.66.3784> sudo apt-mark hold startup-tools

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list startup-tools sudo dnf downgrade startup-tools-<VERSION_BEFORE_12.0.66.3784> sudo dnf versionlock add startup-tools

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: INNEO Startup TOOLS 2018 M040 13.0.70.3804 - Remote Code Execution

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-15492?

startup tools: upgrade to newer than 13.0.70.3804. Exact commands for each OS are on this page.

Is CVE-2020-15492 being exploited?

CVE-2020-15492 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-15492 affect?

CVE-2020-15492 affects startup tools. Severity is critical (CVSS 9.8). An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This

How urgent is CVE-2020-15492?

Priority 69/100. Critical severity; EPSS top 3%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action

References

← Back to latest CVEs