Lucene search

KrcertCVE-2020-7869

HistoryJun 29, 2021 - 2:15 p.m.

CVE-2020-7869

2021-06-2914:15:08

CWE-20

krcert

web.nvd.nist.gov

cve-2020-7869

vulnerability

zook software

remote administration tool

arbitrary file

tight file cmd

execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

70.0%

JSON

An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary file. The ZOOK viewer has the “Tight file CMD” function to create file. An attacker could create and execute arbitrary file in the ZOOK agent program using “Tight file CMD” without authority.

Affected configurations

Nvd

Node

mastersoftzookMatch2.0.4.6

AND

microsoftwindowsMatch-

VendorProductVersionCPE
mastersoftzook2.0.4.6cpe:2.3:a:mastersoft:zook:2.0.4.6:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mastersoft	zook	2.0.4.6	cpe:2.3:a:mastersoft:zook:2.0.4.6:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "platforms": [
      "Windows"
    ],
    "product": "ZOOK",
    "vendor": "mastersoft",
    "versions": [
      {
        "lessThanOrEqual": "2.0.4.6",
        "status": "affected",
        "version": "2.0.4.6",
        "versionType": "custom"
      }
    ]
  }
]

References

www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36090

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

70.0%

JSON

Related for CVE-2020-7869