CVE-2020-7830

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

RAONWIZ v2018.0.2.50 and earlier versions contains a vulnerability that could allow remote files to be downloaded by lack of validation. Vulnerabilities in downloading with Kupload agent allow files to be downloaded to arbitrary paths due to insufficient verification of extensions and download paths. This issue affects: RAONWIZ RAON KUpload 2018.0.2.50 versions and earlier.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
RAONWIZ	RAON KUpload	<=2018.0.2.50

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35582Third Party Advisory
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35582Third Party Advisory

Timeline

Published: Sep 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-78318.8A vulnerability in the web-based contract management service interface Ebiz4u of INOGARD could allow an victim user to download any file. Th CVE-2020-78329.8A vulnerability (improper input validation) in the DEXT5 Upload solution allows an unauthenticated attacker to download and execute an arbit CVE-2020-78367.8VOICEYE WSActiveBridgeES versions prior to 2.1.0.3 contains a stack-based buffer overflow vulnerability caused by improper bound checking pa CVE-2020-78378.8An issue was discovered in ML Report Program. There is a stack-based buffer overflow in function sub_41EAF0 at MLReportDeamon.exe. The funct CVE-2020-78388.8A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute CVE-2020-78399.8In MaEPSBroker 2.5.0.31 and prior, a command injection vulnerability caused by improper input validation checks when parsing brokerCommand p CVE-2020-78418.8Improper input validation vulnerability exists in TOBESOFT XPLATFORM which could cause arbitrary .hta file execution when the command string CVE-2020-78426.6Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the CVE-2020-78459.8Spamsniper 5.0 ~ 5.2.7 contain a stack-based buffer overflow vulnerability caused by improper boundary checks when parsing MAIL FROM command CVE-2020-78468.8Helpcom before v10.0 contains a file download and execution vulnerability caused by storing hardcoded cryptographic key. It finally leads to CVE-2020-78478.0The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain CVE-2020-78488.0The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability,