What is CVE-2020-14030?

CVE-2020-14030 is a high-severity vulnerability in Ozeki Ng Sms Gateway, classified under Deserialization of Untrusted Data. CVSS score: 7.2/10. Published 2020-09-30.

How severe is CVE-2020-14030?

High severity. CVSS v3 base score is 7.2 out of 10.

Deserialization in Ozeki Ng Sms Gateway

CVE-2020-14030

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating (and writing to the disk) malicious .NET serialized files, an attacker can trick the product into deserializing them, resulting in arbitrary code execution.

Vulnerability class: Insecure Deserialization

EPSS: 0.018 (76.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Ozeki Ozeki_ng_sms_gateway
N/a — versions n/a

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-14030?: CVE-2020-14030 is a high-severity vulnerability in Ozeki Ng Sms Gateway, classified under Deserialization of Untrusted Data. CVSS score: 7.2/10. Published 2020-09-30.
How severe is CVE-2020-14030?: High severity. CVSS v3 base score is 7.2 out of 10.