PT-2020-13845 · Ozeki · Ozeki Ng Sms Gateway

Drunkenshells · Published 2020-09-18 · Updated 2020-09-26 · CVE-2020-14021

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ozeki NG SMS Gateway versions through 4.17.6

Description An issue in the ASP.net SMS module allows it to read and validate the source code of ASP files. By altering the path, it can be made to read any file on the Operating System, usually with NT AUTHORITYSYSTEM privileges.

Recommendations For Ozeki NG SMS Gateway versions through 4.17.6, consider restricting access to the ASP.net SMS module until a patch is available. As a temporary workaround, limit the module's ability to read files outside its intended directory to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2020-14021

Affected Products

Ozeki Ng Sms Gateway

References · 5

• 🔥 https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14021-Arbitrary%20File%20Read-Ozeki%20SMS%20Gateway · Exploit
• https://osv.dev/vulnerability/CVE-2020-14021 · Vendor Advisory
• https://ozeki.hu/index.php?ow_page_number=1017&downloadaction=email&download_product_id=1&os=windows&dpath=%2Fattachments%2F702%2Finstallwindows_1590575794_OzekiNG-SMS-Gateway_4.17.6.zip&dname=Ozeki+NG+SMS+Gateway+v4.17.6&dsize=+%2817.8+MB%29&platform=Windows · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14021 · Security Note
• https://ozeki.hu/index.php?owpn=231 · Vendor Advisory