by Kastro
Paper/Archive/CVE-2020-7812

CVE-2020-7812

Kaoni ezHTTPTrans — Kaoni ezHTTPTrans Active-X File Download and Execution Vulnerability

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.9.549 × 2011.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow remote attacker to download arbitrary file by setting the arguments to the activex method. This can be leveraged for code execution by rebooting the victim’s PC.

Affected

ProductAffectedFixed inSource
ezHTTPTrans1.0.0.70 – 1.0.0.90–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
krcert (CNA)7.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

refkaoni.comrefboho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35428