by Kastro
Paper/Archive/CVE-2020-7826

CVE-2020-7826

Bflysoft EyeSurfer BflyInstallerX.ocx — EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setti…

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.4.544 × 2010.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

EyeSurfer BflyInstallerX.ocx v1.0.0.16 and earlier versions contain a vulnerability that could allow remote files to be download by setting the arguments to the vulnerable method. This can be leveraged for code execution. When the vulnerable method is called, they fail to properly check the parameters that are passed to it.

Affected

ProductAffectedFixed inSource
EyeSurfer BflyInstallerX.ocx1.0.0.16 and earlier versions–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
krcert (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

refboho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35512