Arbitrary File Upload Vulnerability in ipTIME NAS Products by ipTIME
CVE-2020-7847

7.4HIGH

Key Information:

Vendor

Efm Networks

Status
Iptime Nas
Vendor
CVE Published:
23 February 2021

What is CVE-2020-7847?

The ipTIME NAS product has a vulnerability that allows for arbitrary file uploads via the Manage Bulletins/Upload feature. Attackers can exploit this flaw to upload malicious files, potentially leading to remote code execution. The affected version, ipTIME NAS 1.4.36, requires immediate attention to mitigate potential security risks that could compromise the system.

Affected Version(s)

ipTIME NAS 1.4.36

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_w...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

JaeHyung Lee, InHyung Lee
.