Vulnerability · Published Feb 3, 2020 · Assigned by twcert
CVE-2020-3925ServiSign Windows Versions- Remote Code Execution via LoadLibrary
High 8.3
In plain English
A high-severity security flaw in ServiSign Windows versions from CHANGING. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities).
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)2.8%top 13.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CHANGING | ServiSign Windows versions | 0 – through 1.0.19.0617 |
References
- https://tvn.twcert.org.tw/taiwanvn/TVN-201910005 x_refsource_MISC
- https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ce x_refsource_MISC