PatchTheCVECVE-2020-24051: The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security
CVE-2020-24051 is a critical-severity flaw (CVSS 9.8) affecting exvf5c-2 firmware, exvp7c2-3 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some of its operations. It was found that the authentication check for those ONVIF operations can be bypassed. An attacker can abuse this issue to execute privileged operations without authentication, for instance, to create a new Administrator user.
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.2% (top 17%) |
| CISA exploited list | No |
| Weakness | CWE-306 |
| Published | 2020-08-21 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-24051?
exvf5c-2 firmware: mitigate or apply the listed mitigation; exvp7c2-3 firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-24051 being exploited?
CVE-2020-24051 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-24051 affect?
CVE-2020-24051 affects exvf5c-2 firmware, exvp7c2-3 firmware. Severity is critical (CVSS 9.8). The Moog EXO Series EXVF5C-2 and EXVP7C2-3 units support the ONVIF interoperability IP-based physical security protocol, which requires authentication for some of its operations. It was found that the authentication check for those ONVIF op
How urgent is CVE-2020-24051?
Priority 65/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2020-24054 CRITICAL 9.8 MITIGATE MITIGATE The administration console of the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units features a 'statusbroadcast' co
- CVE-2020-24053 HIGH 7.5 MITIGATE MITIGATE Moog EXO Series EXVF5C-2 and EXVP7C2-3 units have a hardcoded credentials vulnerability
- CVE-2020-24052 CRITICAL 9.1 MITIGATE MITIGATE Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow re