PT-2020-19816 · Nexacro · Nexacro14/17 Extcommonapiv13 Library

Joengun Baek · Published 2020-07-02 · Updated 2020-07-14 · CVE-2020-7820

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nexacro14/17 ExtCommonApiV13 Library versions prior to 2019.9.6

Description The issue allows a remote attacker to execute arbitrary code by setting the arguments to the vulnerable API, which can be leveraged for code execution by rebooting the victim's PC.

Recommendations For versions prior to 2019.9.6, update to a version 2019.9.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-7820

Affected Products

Nexacro14/17 Extcommonapiv13 Library

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-7820 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7820 · Vendor Advisory
• https://krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35491 · Note
• http://support.tobesoft.co.kr/Support/index.html · Note
• https://t.me/cvenotify/4802 · Telegram Post