CVE-2020-14030
Summary
| CVE | CVE-2020-14030 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2020-09-30 18:15:00 UTC |
| Updated | 2020-10-09 18:42:00 UTC |
| Description | An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating (and writing to the disk) malicious .NET serialized files, an attacker can trick the product into deserializing them, resulting in arbitrary code execution. |
Risk And Classification
Problem Types: CWE-502
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ozeki | Ozeki Ng Sms Gateway | All | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Disclosures/CVE-2020-14030-RCE via .NET Deserialization-Ozeki SMS Gateway at master · DrunkenShells/Disclosures · GitHub | MISC | github.com | Patch, Third Party Advisory |
| Ozeki - Download Ozeki Software Products | MISC | www.ozeki.hu | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.