CVE-2020-25848

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
HGiga	MailSherlock MSR45/SSR45	>= unspecified, < 243
HGiga	MailSherlock MSR45/SSR45	>= unspecified, < 114
HGiga	MailSherlock MSR45/SSR45	>= unspecified, < 122
HGiga	MailSherlock MSR45/SSR45	>= unspecified, < 143
HGiga	MailSherlock MSR45/SSR45	>= unspecified, < 130

References

https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.htmlThird Party Advisory

Timeline

Published: Dec 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-258498.8MailGates and MailAudit products contain Command Injection flaw, which can be used to inject and execute system commands from the cgi parame CVE-2020-25855.9Vulnerability in the Java SE product of Oracle Java SE (component: JavaFX). The supported version that is affected is Java SE: 8u231. Diffic CVE-2020-258507.5The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to downl CVE-2020-258537.5The function CheckMic() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not va CVE-2020-258548.1The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does CVE-2020-258558.1The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not CVE-2020-258568.1The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does CVE-2020-258577.5The function ClientEAPOLKeyRecvd() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) CVE-2020-258587.5The QCMAP_Web_CLIENT binary in the Qualcomm QCMAP software suite prior to versions released in October 2020 does not validate the return val CVE-2020-258596.7The QCMAP_CLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system() call without validatin CVE-2020-25869.9Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Hierarchy Diagrammers). Supported versions that a CVE-2020-258606.6The install.c module in the Pengutronix RAUC update client prior to version 1.5 has a Time-of-Check Time-of-Use vulnerability, where signatu