CVE-2020-7847

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
EFM Networks	ipTIME NAS	1.4.36

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35921Third Party Advisory
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35921Third Party Advisory

Timeline

Published: Feb 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-78488.0The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability,CVE-2020-78498.8A vulnerability of uPrism.io CURIX(Video conferecing solution) could allow an unauthenticated attacker to execute arbitrary code. This vulne CVE-2020-78507.8NBBDownloader.ocx ActiveX Control in Groupware contains a vulnerability that could allow remote files to be downloaded and executed by setti CVE-2020-78517.8Innorix Web-Based File Transfer Solution versuibs prior to and including 9.2.18.385 contains a vulnerability that could allow remote files t CVE-2020-78527.8DaviewIndy has a Heap-based overflow vulnerability, triggered when the user opens a malformed ex.j2c format file that is mishandled by Davie CVE-2020-78539.8An outbound read/write vulnerability exists in XPLATFORM that does not check offset input ranges, allowing out-of-range data to be read. An CVE-2020-78569.8A vulnerability of Helpcom could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficie CVE-2020-78579.8A vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insuffic CVE-2020-78588.6There is a directory traversing vulnerability in the download page url of AquaNPlayer 2.0.0.92. The IP of the download page url is localhost CVE-2020-78607.8UnEGG v0.5 and eariler versions have a Integer overflow vulnerability, triggered when the user opens a malformed specific file that is misha CVE-2020-78619.8AnySupport (Remote support solution) before 2019.3.21.0 allows directory traversing because of swprintf function to copy file from a managem CVE-2020-78628.8A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands