CVE-2020-14030

Katalog CVE

CVSS 7.2 · High EPSS 1,8%

Kerentanan Deserialization of Untrusted Data pada ozeki ng sms gateway. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating (and writing to the disk) malicious .NET serialized files, an attacker can trick the product into deserializing them, resulting in arbitrary code execution.

Rincian

Terbit di NVD

30 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.ozeki.hu/index.php?owpn=231 advisory vendor
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14030-RCE%20via%20.NET%20Deserialization-Oze... patch · advisory pihak ketiga