Linuxki - RCE (CVE-2020-7209)

CVE-2020-7209 is a critical remote code execution vulnerability affecting LinuxKI, allowing attackers to execute arbitrary commands via crafted requests to a diagnostic interface.

CrowdSec has been tracking this vulnerability and its exploits since 27th of May 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2020-7209 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2020-7209. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Observed exploitation attempts are focused on URLs containing /linuxki/experimental/vis/kivis.php.