CVE-2020-14022 File upload in n/a

High 8.8 Published 22 Sep 2020 Updated 4 Aug 2024

Attackers can upload executable files via the contact import feature to achieve remote code execution on the SMS gateway server.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-14022?

CVE-2020-14022 is a high-severity vulnerability in n/a, published on 22 Sep 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality (E.g. the "Application Starter" module) within the application.

Weakness: CWE-434

Which versions are affected by CVE-2020-14022?

It affects 1 product.

Products include Ozeki Ozeki Ng Sms Gateway.

How do I fix CVE-2020-14022?

No fix has been published for CVE-2020-14022 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-14022 being exploited?

There is no known exploitation of CVE-2020-14022 in the wild and no public exploit code.

Sources

Also known as GHSA-9q88-264f-9cgp.