CVE-2020-25843

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

NHIServiSignAdapter fails to verify the length of digital credential files’ path which leads to a heap overflow loophole. Remote attackers can use the leak to execute code without privilege.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Dec 31, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-258449.8The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loopholeCVE-2020-258457.4Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a maliciCVE-2020-258467.4The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redirCVE-2020-258478.8This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed thCVE-2020-258489.8HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.CVE-2020-258498.8MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parameCVE-2020-25855.9Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u231. DifficCVE-2020-258507.5The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to downlCVE-2020-258537.5The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not vaCVE-2020-258548.1The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does CVE-2020-258558.1The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not CVE-2020-258568.1The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does