CHANGING Inc. NHIServiSignAdapter Windows Versions - Arbitrary File Access
CVE-2020-25842

7.5HIGH

Key Information:

Vendor: Changing Inc.
Status: Nhiservisignadapter
Vendor: CVE Published:; 31 December 2020

🔔 Create Changing Inc. Vulnerability Alert

What is CVE-2020-25842?

The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege.

Affected Version(s)

NHIServiSignAdapter Windows 1.0.20.0218

References

https://www.twcert.org.tw/tw/cp-132-4270-72392-1.html

x_refsource_MISC

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 31, 2020
Vulnerability Reserved
Sep 23, 2020

Credit

DEVCORE

CVE-2020-25842 Data

JSON