1. Home
  2. CVE Database
  3. CVE-2020-7847
HIGH · 7.4

CVE-2020-7847

The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.

Vulnerability Description

The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.

CVSS Score

7.4

HIGH

CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
IptimeNas-I Firmware< 1.4.36
IptimeNas-I-
IptimeNas-Ii Firmware< 1.4.36
IptimeNas-Ii-
IptimeNas-Iie Firmware< 1.4.36
IptimeNas-Iie-
IptimeNas101 Firmware< 1.4.36
IptimeNas101-
IptimeNas1Dual Firmware< 1.4.36
IptimeNas1Dual-
IptimeNas2Dual Firmware< 1.4.36
IptimeNas2Dual-
IptimeNas3 Firmware< 1.4.36
IptimeNas3-
IptimeNas4 Firmware< 1.4.36
IptimeNas4-
IptimeNas4Dual Firmware< 1.4.36
IptimeNas4Dual-

Related Weaknesses (CWE)

CWE-434

References

FAQ

What is CVE-2020-7847?

CVE-2020-7847 is a vulnerability with a CVSS score of 7.4 (HIGH). The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.

How severe is CVE-2020-7847?

CVE-2020-7847 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-7847?

Check the references section above for vendor advisories and patch information. Affected products include: Iptime Nas-I Firmware, Iptime Nas-I, Iptime Nas-Ii Firmware, Iptime Nas-Ii, Iptime Nas-Iie Firmware.