CVE-2020-7869 File upload in ZOOK
A remote attacker can create and execute arbitrary files on the ZOOK agent via the Tight file CMD function without proper authorization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-7869?
CVE-2020-7869 is a critical vulnerability in mastersoft ZOOK, published on 29 Jun 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An improper input validation vulnerability of ZOOK software (remote administration tool) could allow a remote attacker to create arbitrary file. The ZOOK viewer has the "Tight file CMD" function to create file. An attacker could create and execute arbitrary file in the ZOOK agent program using "Tight file CMD" without authority.
Weakness: CWE-20
Which versions are affected by CVE-2020-7869?
It affects 1 product.
Products include Mastersoft Zook.
How do I fix CVE-2020-7869?
No fix has been published for CVE-2020-7869 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-7869 being exploited?
There is no known exploitation of CVE-2020-7869 in the wild and no public exploit code.
Sources
Also known as GHSA-wqpm-3q37-8x6w.