CVE-2020-25848: HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism

Critical severity · published Dec 31, 2020

CVE-2020-25848

HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism

9.8

CVSS

1.7%

EPSS

On KEV

Description

HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.7% · higher than 77% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Msr45 Isherlock-antispam · Hgiga

before 4.5-130 · source: NVD

Msr45 Isherlock-audit · Hgiga

before 4.5-143 · source: NVD

Msr45 Isherlock-base · Hgiga

before 4.5-243 · source: NVD

Msr45 Isherlock-user · Hgiga

before 4.5-114 · source: NVD

Msr45 Isherlock-useradmin · Hgiga

before 4.5-122 · source: NVD

Ssr45 Isherlock-antispam · Hgiga

before 4.5-130 · source: NVD

Ssr45 Isherlock-audit · Hgiga

before 4.5-143 · source: NVD

Ssr45 Isherlock-base · Hgiga

before 4.5-243 · source: NVD

Ssr45 Isherlock-user · Hgiga

before 4.5-114 · source: NVD

Ssr45 Isherlock-useradmin · Hgiga

before 4.5-112 · source: NVD

Affected product

Msr45 Isherlock-antispam

Hgiga

All Msr45 Isherlock-antispam CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-25848

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-25848

Third Party Advisory

https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html