Lucene search

TwcertCVE-2020-25842

HistoryDec 31, 2020 - 8:15 a.m.

CVE-2020-25842

2020-12-3108:15:12

CWE-311

twcert

web.nvd.nist.gov

nhiservisignadapter

encryption

vulnerability

remote access

file path

nvd

cve-2020-25842

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.004

Percentile

72.8%

JSON

The encryption function of NHIServiSignAdapter fail to verify the file path input by users. Remote attacker can access arbitrary files through the flaw without privilege.

Affected configurations

Nvd

Node

panoramanhiservisignadapterMatch1.0.20.0218windows

VendorProductVersionCPE
panoramanhiservisignadapter1.0.20.0218cpe:2.3:a:panorama:nhiservisignadapter:1.0.20.0218:*:*:*:*:windows:*:*

Vendor	Product	Version	CPE
panorama	nhiservisignadapter	1.0.20.0218	cpe:2.3:a:panorama:nhiservisignadapter:1.0.20.0218:::::windows::

CNA Affected

[
  {
    "platforms": [
      "Windows"
    ],
    "product": "NHIServiSignAdapter",
    "vendor": "CHANGING Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.20.0218"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-4270-72392-1.html

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.004

Percentile

72.8%

JSON

Related for CVE-2020-25842