PT-2021-12690 · Zook · Zook

Published 2021-06-29 · Updated 2021-07-02 · CVE-2020-7869

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ZOOK software (affected versions not specified)

Description: An improper input validation issue in the ZOOK software, a remote administration tool, could allow a remote attacker to create arbitrary files. The ZOOK viewer has a Tight file CMD function that enables file creation. An attacker could exploit this to create and execute arbitrary files in the ZOOK agent program using Tight file CMD without proper authority.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-7869

Affected Products

Zook

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-7869 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7869 · Vendor Advisory
• https://t.me/cvenotify/17010 · Telegram Post
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36090 · Note