CVE-2020-7863: Raonwiz RAON K Upload Arbitrary Command Execution Vulnerability
First published: Thu Aug 05 2021(Updated: )
A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could exploit this vulnerability by setting the parameter to the command they want to execute. A successful exploit could allow the attacker to execute arbitrary commands on a target system as the user. However, the victim must run the Internet Explorer browser with administrator privileges because of the cross-domain policy.
Credit: vuln@krcert.or.kr
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Raonwiz Raon K Upload | <2018.0.2.56 |
Remedy
Update software over RAON K Uploader 2018.0.2.56 version or higher.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-7863.
What is the severity of CVE-2020-7863?
CVE-2020-7863 has a severity of 8.8 (Critical).
What software is affected by CVE-2020-7863?
The affected software is Raonwiz Raon K Upload up to version 2018.0.2.56.
How can an attacker exploit CVE-2020-7863?
An attacker can exploit CVE-2020-7863 by setting a specially-crafted parameter in a web page.
Are there any references available for CVE-2020-7863?
Yes, you can find references for CVE-2020-7863 at the following links: [link1](http://www.raonk.com/page/customs/modify.aspx?pSeq=20&pageno=1), [link2](https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36166).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/author
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/raonwiz
- canonical/raonwiz raon k upload