CVE-2020-3927

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An arbitrary-file-access vulnerability exists in ServiSign security plugin, as long as the attackers learn the specific API function, they may access arbitrary files on target system via crafted API parameter.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-552

Affected software

Vendor	Product	Versions
CHANGING	ServiSign Windows versions	<= 1.0.19.0617

References

https://tvn.twcert.org.tw/taiwanvn/TVN-201910007Third Party Advisory
https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ceThird Party Advisory
https://tvn.twcert.org.tw/taiwanvn/TVN-201910007Third Party Advisory
https://www.chtsecurity.com/news/1179d48b-7609-4f67-9d7e-3bac2979c6ceThird Party Advisory

Timeline

Published: Feb 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-39289.8GeoVision Door Access Control device family is hardcoded with a root password, which adopting an identical password in all devices.CVE-2020-39295.9GeoVision Door Access Control device family employs shared cryptographic private keys for SSH and HTTPS. Attackers may conduct MITM attack w CVE-2020-39303.3GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs.CVE-2020-39319.8Buffer overflow exists in Geovision Door Access Control device family, an unauthenticated remote attacker can execute arbitrary command.CVE-2020-39327.5A vulnerable SNMP in Draytek VigorAP910C cannot be disabled, which may cause information leakage.CVE-2020-39335.3TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, allows attackers to enumerate and exam user accoun CVE-2020-39349.8TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, contains a vulnerability of Pre-auth SQL Injection CVE-2020-39357.5TAIWAN SECOM CO., LTD., a Door Access Control and Personnel Attendance Management system, stores users’ information by cleartext in the cook CVE-2020-39369.8UltraLog Express device management interface does not properly filter user inputted string in some specific parameters, attackers can inject CVE-2020-39377.5SQL Injection in SysJust Syuan-Gu-Da-Shih, versions before 20191223, allowing attackers to perform unwanted SQL queries and access arbitrary CVE-2020-39387.5SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Request Forgery, allowing attackers to launch inquiries into ne CVE-2020-39396.1SysJust Syuan-Gu-Da-Shih, versions before 20191223, contain vulnerability of Cross-Site Scripting(XSS), personal information may be leaked t