CVE-2020-14030 Deserialization in n/a
Attackers can achieve arbitrary code execution by tricking the SMS Gateway into deserializing malicious .NET files stored on the filesystem.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-14030?
CVE-2020-14030 is a high-severity unsafe deserialization vulnerability in n/a, published on 29 Sep 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating (and writing to the disk) malicious .NET serialized files, an attacker can trick the product into deserializing them, resulting in arbitrary code execution.
Weakness: CWE-502
Which versions are affected by CVE-2020-14030?
It affects 1 product.
Products include Ozeki Ozeki Ng Sms Gateway.
How do I fix CVE-2020-14030?
No fix has been published for CVE-2020-14030 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-14030 being exploited?
There is no known exploitation of CVE-2020-14030 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-xfxx-vmw5-vf7w.