CVE-2020-7874CWE-494

NEXACRO14 Runtime arbitrary file download and execution vulnerability

High · published September 9, 2021

CVSS v3.1
8.8
EPSS
1%
Percentile
47.2
In the wild
Unconfirmed
What it is

Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00584 · 47.2th percentile
Weakness
CWE-494 · Download of Code Without Integrity Check
Published
2021-09-09T12:49Z
EPSS history
Timeline
  • 09 SEP 12:49Z
    NEXACRO14 Runtime arbitrary file download and execution vulnerability
    cvelistv5