CVE-2020-7825

A vulnerability exists that could allow the execution of operating system commands on systems running MiPlatform 2019.05.16 and earlier. An attacker could execute arbitrary remote command by sending parameters to WinExec function in ExtCommandApi.dll module of MiPlatform.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
krcertCNA
8.8 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 65%
VendorProductVersion
tobesoftmiplatform
𝑥
≤ 2019.05.16
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35509
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35509