CVE-2020-7821

{"containers": {"cna": {"affected": [{"platforms": ["Windows OS"], "product": "NEXACRO14/17 ExCommonApiV13", "vendor": "Tobesoft", "versions": [{"lessThan": "2019.9.6", "status": "affected", "version": "2019.9.6", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Thanks to Joengun Baek for this vulnerability report."}], "descriptions": [{"lang": "en", "value": "Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the value of registry path. This can be leveraged for code execution by rebooting the victim\u2019s PC"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-07-02T12:37:35.000Z", "orgId": "cdd7a122-0fae-4202-8d86-14efbacc2863", "shortName": "krcert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://support.tobesoft.co.kr/Support/index.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35491"}], "source": {"discovery": "EXTERNAL"}, "title": "Tobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution Vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "vuln@krcert.or.kr", "ID": "CVE-2020-7821", "STATE": "PUBLIC", "TITLE": "Tobesoft NEXACRO14/17 ExCommonApiV13 Arbitrary Code Execution Vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "NEXACRO14/17 ExCommonApiV13", "version": {"version_data": [{"platform": "Windows OS", "version_affected": "<", "version_name": "2019.9.6", "version_value": "2019.9.6"}]}}]}, "vendor_name": "Tobesoft"}]}}, "credit": [{"lang": "eng", "value": "Thanks to Joengun Baek for this vulnerability report."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the value of registry path. This can be leveraged for code execution by rebooting the victim\u2019s PC"}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-20 Improper Input Validation"}]}]}, "references": {"reference_data": [{"name": "http://support.tobesoft.co.kr/Support/index.html", "refsource": "CONFIRM", "url": "http://support.tobesoft.co.kr/Support/index.html"}, {"name": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35491", "refsource": "CONFIRM", "url": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35491"}]}, "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:41:01.859Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://support.tobesoft.co.kr/Support/index.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35491"}]}]}, "cveMetadata": {"assignerOrgId": "cdd7a122-0fae-4202-8d86-14efbacc2863", "assignerShortName": "krcert", "cveId": "CVE-2020-7821", "datePublished": "2020-07-02T12:37:35.000Z", "dateReserved": "2020-01-22T00:00:00.000Z", "dateUpdated": "2024-08-04T09:41:01.859Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"platforms": ["Windows OS"], "product": "NEXACRO14/17 ExCommonApiV13", "vendor": "Tobesoft", "versions": [{"lessThan": "2019.9.6", "status": "affected", "version": "2019.9.6", "versionType": "custom"}]}], "source": "vuln@krcert.or.kr"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nexaweb:nexacro_14:*:*:*:*:*:*:*:*", "matchCriteriaId": "4E95DFB8-11DE-451A-9F7E-FE94E9F67702", "versionEndExcluding": "2019.9.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:nexaweb:nexacro_17:*:*:*:*:*:*:*:*", "matchCriteriaId": "14D39089-6FA2-4FFA-865A-D11171BC058B", "versionEndExcluding": "2019.9.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nexacro14/17 ExtCommonApiV13 Library under 2019.9.6 version contain a vulnerability that could allow remote attacker to execute arbitrary code by modifying the value of registry path. This can be leveraged for code execution by rebooting the victim\u2019s PC"}, {"lang": "es", "value": "Nexacro14/17 ExtCommonApiV13 Library versi\u00f3n 2019.9.6, contiene una vulnerabilidad que podr\u00eda permitir a un atacante remoto ejecutar c\u00f3digo arbitrario mediante la modificaci\u00f3n del valor de la ruta del registro. Esto puede ser aprovechado para la ejecuci\u00f3n del c\u00f3digo mediante el reinicio de la PC de la v\u00edctima"}], "id": "CVE-2020-7821", "lastModified": "2026-06-17T03:25:30.413", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "vuln@krcert.or.kr", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-07-02T13:15:10.590", "references": [{"source": "vuln@krcert.or.kr", "tags": ["Third Party Advisory"], "url": "http://support.tobesoft.co.kr/Support/index.html"}, {"source": "vuln@krcert.or.kr", "tags": ["Third Party Advisory"], "url": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35491"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://support.tobesoft.co.kr/Support/index.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35491"}], "sourceIdentifier": "vuln@krcert.or.kr", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "vuln@krcert.or.kr", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}