Paper/Archive/CVE-2020-7825

CVE-2020-7825

TOBESOFT MiPlatform 320, 320U, 330, 330U — A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier.

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 81.6.816 × 2016.3 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. An attacker could execute arbitrary remote command by sending parameters to WinExec function in ExtCommandApi.dll module of MiPlatform.

Affected

ProductAffectedFixed inSource

MiPlatform 320, 320U, 330, 330U2019.05.16 and earlier versions–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

krcert (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

refboho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35509