CVE-2020-3925

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin, as long as the interface is captured, attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
CHANGING	ServiSign Windows versions	<= 1.0.19.0617

References

https://tvn.twcert.org.tw/taiwanvn/TVN-201910005Third Party Advisory
https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ceThird Party Advisory
https://tvn.twcert.org.tw/taiwanvn/TVN-201910005Third Party Advisory
https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ceThird Party Advisory

Timeline

Published: Feb 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-39267.5An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they m CVE-2020-39277.5An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they m CVE-2020-39289.8GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.CVE-2020-39295.9GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack w CVE-2020-39303.3GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.CVE-2020-39319.8Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.CVE-2020-39327.5A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.CVE-2020-39335.3TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user accoun CVE-2020-39349.8TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection CVE-2020-39357.5TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cook CVE-2020-39369.8UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject CVE-2020-39377.5SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary