PT-2020-19821 · Xiaomi · Miplatform

Published 2020-07-17 · Updated 2020-07-23 · CVE-2020-7825

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MiPlatform versions prior to 2019.05.16

Description A vulnerability exists that could allow the execution of operating system commands. An attacker could execute arbitrary remote commands by sending parameters to the WinExec function in the ExtCommandApi.dll module.

Recommendations For versions prior to 2019.05.16, consider restricting access to the ExtCommandApi.dll module to minimize the risk of exploitation. As a temporary workaround, avoid using the WinExec function until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-7825

Affected Products

Miplatform

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-7825 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7825 · Vendor Advisory
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35509 · Note