CVE-2020-7869 — CRITICAL (9.0)

Vulnerability Description

An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary file. The ZOOK viewer has the "Tight file CMD" function to create file. An attacker could create and execute arbitrary file in the ZOOK agent program using "Tight file CMD" without authority.

CVSS Score

9.0

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Mastersoft	Zook	2.0.4.6
Microsoft	Windows	-

Related Weaknesses (CWE)

CWE-20

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36090Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36090Third Party Advisory

FAQ

What is CVE-2020-7869?

CVE-2020-7869 is a vulnerability with a CVSS score of 9.0 (CRITICAL). An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary file. The ZOOK viewer has the "Tight file CMD" function to cr...

How severe is CVE-2020-7869?

CVE-2020-7869 has been rated CRITICAL with a CVSS base score of 9.0/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-7869?

Check the references section above for vendor advisories and patch information. Affected products include: Mastersoft Zook, Microsoft Windows.