CVE-2020-7878 Code injection in VideoOffice
Attackers can download and execute arbitrary files due to missing integrity checks in VideoOffice, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7878?
CVE-2020-7878 is a critical code injection vulnerability in 4NB VideoOffice, published on 28 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing support for integrity check.
Which versions are affected by CVE-2020-7878?
It affects 1 product.
Products include 4nb Videooffice.
How do I fix CVE-2020-7878?
No fix has been published for CVE-2020-7878 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-7878 being exploited?
There is no known exploitation of CVE-2020-7878 in the wild and no public exploit code.
Sources
Also known as GHSA-7p6q-fmrv-hfqg.