Vulnerability · Published May 7, 2020 · Assigned by krcert
CVE-2020-7803Zoneplayer ActiveX File Download Vulnerability
High 7.8
In plain English
A high-severity improper input validation in Zoneplayer from IMGTech Co,Ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)1.2%top 32.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
IMGTech Co,Ltd ZInsX.ocx ActiveX Control in Zoneplayer 2.0.1.3, version 2.0.1.4 and prior versions on Windows. File Donwload vulnerability in ZInsX.ocx of IMGTech Co,Ltd Zoneplayer allows attacker to cause arbitrary code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IMGTech Co,Ltd | Zoneplayer | 2.0.1.4 and prior |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35346 x_refsource_CONFIRM
- http://www.zoneplayer.co.kr/ x_refsource_CONFIRM