CVE-2020-35364: Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code in

This week

CRITICAL 9.8REMOTEDOWNGRADE

CVE-2020-35364 is a critical-severity flaw (CVSS 9.8) affecting internet security. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting for a Huorong services restart or a system reboot.

Why this priority

Critical severity
Public exploit reference
Remotely exploitable, no login, no user action

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	1.9% (top 20%)
CISA exploited list	No
Published	2020-12-26
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: huorong

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-12-26 19:15 UTCPublished CVE record published
2026-06-17 03:13 UTCUpdated Record last modified

huorong internet security DOWNGRADE

Affected: 5.0.55.2

Fixed in: no fixed release known

Safe to downgrade to: a release before 5.0.55.2

1. Check installed version

apt-cache policy internet-security || rpm -q internet-security || internet-security --version

2. No fixed release: DOWNGRADE to a release before 5.0.55.2 (Debian / Ubuntu)

apt-cache madison internet-security sudo apt install internet-security=<VERSION_BEFORE_5.0.55.2> sudo apt-mark hold internet-security

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list internet-security sudo dnf downgrade internet-security-<VERSION_BEFORE_5.0.55.2> sudo dnf versionlock add internet-security

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-35364?

internet security: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-35364 being exploited?

CVE-2020-35364 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-35364 affect?

CVE-2020-35364 affects internet security. Severity is critical (CVSS 9.8). Beijing Huorong Internet Security 5.0.55.2 allows a non-admin user to escalate privileges by injecting code into a process, and then waiting for a Huorong services restart or a system reboot.

How urgent is CVE-2020-35364?

Priority 64/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action

Related CVEs

CVE-2025-7073 HIGH 7.8 UPGRADE UPGRADE A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows
CVE-2026-6851 HIGH 7.0 UPGRADE UPGRADE An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as
CVE-2026-27750 HIGH 7.8 UPGRADE Avira Internet Security contains a time-of-check time-of-use (TOCTOU) vulnerability in the Optimizer component
CVE-2026-27749 HIGH 7.8 UPGRADE Avira Internet Security contains a deserialization of untrusted data vulnerability in the System Speedup compo
CVE-2026-27748 HIGH 7.8 UPGRADE Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component

References

← Back to latest CVEs