Vulnerability · Published Apr 22, 2021 · Assigned by krcert
CVE-2020-7861AnySupport directory traversing vulnerability
High 8.4
In plain English
A high-severity security flaw in AquaNPlayer from Koino. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)1.5%top 26.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
AnySupport (Remote support solution) before 2019.3.21.0 allows directory traversing because of swprintf function to copy file from a management PC to a client PC. This can be lead to arbitrary file execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Koino | AquaNPlayer | 2019.3.21.0 – through 2019.3.21.0 |
Weakness: CWE-23 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
References
- https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36016 x_refsource_CONFIRM