CVE-2020-13122: Noviflow Noviware

High severity, CVSS 8.8. EPSS: 7.1% chance of exploitation in the next 30 days.

The novish command-line interface, included in NoviFlow NoviWare before NW500.2.12 and deployed on NoviSwitch devices, is vulnerable to command injection in the "show status destination ipaddr" command. This could be used by a read-only user (monitoring group) or admin to execute commands on the operating system.

Affected products

• Noviflow Noviware: up to and including nw500.2.12

Published 2020-08-17. Last modified 2026-06-17.