Vulnerability · CVE-2020-13945

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules.

Q: Which versions are affected?

Compare what you have installed with >= 1.2, <= 1.5. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Q: What should an analyst verify?

No weakness class is stored. EPSS 73.58%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Published Dec 7, 2020 · catalog updated Oct 27, 2026 · Apache APISIX

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Patch now

CVE-2020-13945 is in the CISA known-exploited catalog. Confirm Apache APISIX against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Same product and reporting

CVE-2022-24112 · Critical · known exploited

Severity: Medium6.5
Known exploitation: CISA KEV and VulnCheck KEV
EPSS: 73.58%
Remediation: Remediation guidance
Affected products: cpe apache/apisix · vendor Apache APISIX · vendor Apache apisix

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5. Initial-access exploit intelligence.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

cpe apache/apisix>= 1.2, <= 1.5
vendor Apache APISIXversion unspecified
vendor Apache apisixversion unspecified

How to fix CVE-2020-13945

Vendor action
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Version check
Affected <= 1.5
Advisory
Open the cve_org record and follow its fix.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2020-13945 is in the CISA known-exploited catalog. Confirm Apache APISIX against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with >= 1.2, <= 1.5. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

What should an analyst verify?

No weakness class is stored. EPSS 73.58%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Oct 27, 2026 · VulnCheck KEV
Detected
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5. Initial-access exploit intelligence.
Oct 27, 2026 · CISA KEV
Known exploited
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Sources

CVE.orgVulnerability recordCVE-2020-13945
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2020-13945
30-day exploitation probability 73.58%
first.org
Metasploit ModulesPublic exploit moduleexploit_multi/http/apache_apisix_api_default_token_rce
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2020-13945
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
nvd.nist.gov
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/166228/Apache-APISIX-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com
VulnCheck KEVConfirmed exploitationCVE-2020-13945
In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5.
vulncheck.com

References

Freshness

Last verified in this catalog Nov 4, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Packet Storm SecurityNov 5, 2026
Metasploit ModulesNov 4, 2026
FIRST EPSSNov 4, 2026
VulnCheck KEVOct 30, 2026
CVE.orgOct 28, 2026
NIST NVDOct 28, 2026

Priority score

75/100

Evidence confidence: Very high

CISA lists this vulnerability as known to be exploited.

Confirmed exploitation30/30
EPSS probability15/20
CVSS severity10/15
Public exploit10/10
Internet exposure10/10
Product prevalence0/5
Detection0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Medium

CVSS severity
6.5 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS probability
73.58% · p99.47%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
Yes · CISA KEV and VulnCheck KEV
CISA KEV since Oct 27, 2026. Ransomware use: Unknown.
Patch availability
Remediation guidance
Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

Stacks

Apache

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.