Vulnerability · Published Dec 31, 2025 · Assigned by VulnCheck

CVE-2020-36904Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint

High 7.5

In plain English

A high-severity missing authentication in Selea CarPlateServer (CPS) from Selea. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 58.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Selea CarPlateServer 4.0.1.6 contains a remote program execution vulnerability that allows attackers to execute arbitrary Windows binaries by manipulating the NO_LIST_EXE_PATH configuration parameter. Attackers can bypass authentication through the /cps/ endpoint and modify server configuration, including changing admin passwords and executing system commands.

Affected products (as reported)

Vendor	Product	Versions
Selea	Selea CarPlateServer (CPS)	4.0.1.6

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ExploitDB-49452 exploit
Vendor Homepage product
Zero Science Lab Disclosure (ZSL-2021-5622) third-party-advisory
VulnCheck Advisory: Selea CarPlateServer 4.0.1.6 Remote Program Execution via Configuration Endpoint third-party-advisory