CVE-2020-14028

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. By leveraging a path traversal vulnerability in the Autoreply module's Script Name, an attacker may write to or overwrite arbitrary files, with arbitrary content, usually with NT AUTHORITY\SYSTEM privileges.

CVSS v3.1 NVD

7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

1.86% chance of exploitation in the next 30 days, 79th percentile

Published

2020-09-22

Updated

2024-08-04

Proof-of-concept exploits (1)

• DrunkenShells/Disclosures/tree/master/CVE-2020-14028-Arbitary%20File%20Write-Ozeki%20SMS%…92★ · 2022-02-13

Security advisories

• http://www.ozeki.hu/index.php?owpn=231

References

• CVE Record
• NVD entry

Related

• CVE-2019-10092
• CVE-2019-11287
• CVE-2019-12401
• CVE-2019-12409
• CVE-2019-1332
• CVE-2019-14678