CVE-2020-7874
High
Description
Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension.
SeverityHigh
CVSS8.8
Exploit probability—
ProductTobesoft Nexacro
PublishedSep 9, 2021
First seenSep 9, 2021
Weakness typeCWE-494CWE-494
How to fix
Update
- tobesoft nexacro14.0.1.3600 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tobesoft nexacro | 14.0.0.0 ≤ v < 14.0.1.3600 | 14.0.1.3600 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.