What is CVE-2020-7874?

CVE-2020-7874 is a high-severity vulnerability in Microsoft Windows, classified under Download of Code Without Integrity Check. CVSS score: 8.8/10. Published 2021-09-09.

How severe is CVE-2020-7874?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Microsoft Windows

CVE-2020-7874

Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension.

EPSS: 0.006 (44.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Affected products

Microsoft Windows
Tobesoft Nexacro
Tobesoft Nexacro14 — versions 14.0.1.3600

Weakness classification (CWE)

CWE-494 — Download of Code Without Integrity Check

References

vuln@krcert.or.kr (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-7874?: CVE-2020-7874 is a high-severity vulnerability in Microsoft Windows, classified under Download of Code Without Integrity Check. CVSS score: 8.8/10. Published 2021-09-09.
How severe is CVE-2020-7874?: High severity. CVSS v3 base score is 8.8 out of 10.