CVE-2020-15591: fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

PriorityP266critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

3.80%

88.7th percentile

fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	fex	< fex 20160919-2 (bookworm)	fex 20160919-2 (bookworm)
ulli_horlacher	fex	>= 0 < 20160919-2	20160919-2
ulli_horlacher	fex	>= 0 < 20160919-2	20160919-2
ulli_horlacher	fex	>= 0 < 20160919-2	20160919-2
ulli_horlacher	fex	>= 0 < 20160919-2	20160919-2
uni-stuttgart	frams_fast_file_exchange	< 20160919_2	20160919_2

Detection & IOCsextracted from sources · hover to see the quote

→Target process is `fexsrv`, the server component of F*EX (Frams' Fast File EXchange); monitor for unexpected child process spawning or eval-based code execution originating from fexsrv ↗
→Vulnerability is eval injection in fexsrv; look for HTTP requests to fexsrv endpoints containing shell metacharacters or code constructs (e.g., backticks, semicolons, piped commands) in user-supplied parameters that would be passed to an eval call ↗
→Exploitation requires no authentication; any unauthenticated request to fexsrv carrying a malicious payload should be treated as a high-severity alert ↗

·Vulnerable versions are all F*EX releases before fex-20160919_2; patched version is 20160919-2 (Debian package) / fex-20160919_2 (upstream). Confirm installed version before treating a host as vulnerable. ↗
·Debian tracks this as resolved in package version 20160919-2 across bookworm, bullseye, forky, sid, and trixie; older/unsupported Debian releases or non-Debian deployments may still be unpatched. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

osv9.8CRITICAL

vendor_debian9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.