CVE-2020-25844

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
CHANGING Inc.	NHIServiSignAdapter	1.0.20.0218

References

https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.htmlThird Party Advisory

Timeline

Published: Dec 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-258457.4Multiple functions of NHIServiSignAdapter failed to verify the users’ file path, which leads to the SMB request being redirected to a malici CVE-2020-258467.4The digest generation function of NHIServiSignAdapter has not been verified for source file path, which leads to the SMB request being redir CVE-2020-258478.8This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed th CVE-2020-258489.8HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.CVE-2020-258498.8MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parame CVE-2020-25855.9Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u231. Diffic CVE-2020-258507.5The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to downl CVE-2020-258537.5The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not va CVE-2020-258548.1The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does CVE-2020-258558.1The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not CVE-2020-258568.1The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does CVE-2020-258577.5The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08)