PT-2020-16241 · Nhi · Nhiservisignadapter

Angelboy + 1 · Published 2020-12-31 · Updated 2021-01-06 · CVE-2020-25845

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NHIServiSignAdapter (affected versions not specified)

Description The issue arises from multiple functions of NHIServiSignAdapter failing to verify the users' file path. This failure leads to the SMB request being redirected to a malicious host, resulting in the leakage of the user's credential.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-25845

Affected Products

Nhiservisignadapter

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-25845 · Security Note
• https://osv.dev/vulnerability/CVE-2020-25845 · Vendor Advisory
• https://twcert.org.tw/tw/cp-132-4273-24e01-1.html · Note
• https://t.me/cibsecurity/21456 · Telegram Post