CHANGING Inc. NHIServiSignAdapter Windows Versions - Information Leakage -2
CVE-2020-25846

7.5HIGH

Key Information:

Vendor: Changing Inc.
Status: Nhiservisignadapter
Vendor: CVE Published:; 31 December 2020

🔔 Create Changing Inc. Vulnerability Alert

What is CVE-2020-25846?

The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirected to a malicious host, resulting in the leakage of user's credential.

Affected Version(s)

NHIServiSignAdapter Windows 1.0.20.0218

References

https://www.twcert.org.tw/tw/cp-132-4274-7bd65-1.html

x_refsource_MISC

CVSS V3.1

Score:

7.5

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Dec 31, 2020
Vulnerability Reserved
Sep 23, 2020

Credit

DEVCORE

CVE-2020-25846 Data

JSON