CHANGING Inc. NHIServiSignAdapter Windows Versions - Heap Overflow
CVE-2020-25843

8.1HIGH

Key Information:

Vendor: Changing Inc.
Status: Nhiservisignadapter
Vendor: CVE Published:; 31 December 2020

🔔 Create Changing Inc. Vulnerability Alert

What is CVE-2020-25843?

NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege.

Affected Version(s)

NHIServiSignAdapter Windows 1.0.20.0218

References

https://www.twcert.org.tw/tw/cp-132-4271-951cd-1.html

x_refsource_MISC

CVSS V3.1

Score:

8.1

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 31, 2020
Vulnerability Reserved
Sep 23, 2020

Credit

DEVCORE

CVE-2020-25843 Data

JSON