CVE-2020-26105: 
cPanel vulnerability analysis and mitigation

In cPanel before version 88.0.3, a security vulnerability was identified where insecure chkservd test credentials were used on a templated VM (SEC-554). This vulnerability was discovered and disclosed on September 25, 2020, affecting cPanel installations prior to version 88.0.3 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is related to improper authentication (CWE-287) in the chkservd service when handling test credentials on templated virtual machines (NVD).

The vulnerability could potentially allow attackers to gain unauthorized access to the system through the insecure test credentials, potentially leading to complete system compromise. Given the CVSS score of 9.8, this represents a critical security risk with potential for high impact on confidentiality, integrity, and availability of the affected systems (NVD).

The vulnerability has a low attack complexity and requires no user interaction for exploitation. It can be accessed from the network without requiring any privileges, making it highly exploitable (NVD).

The primary mitigation is to upgrade to cPanel version 88.0.3 or later, which contains the fix for this vulnerability. This update addresses the insecure credential handling in the chkservd service (cPanel Changelog).