CVE-2020-25844 - CHANGING Inc. NHIServiSignAdapter Windows Versions

Back Back to CVE browser

CRITICAL

CHANGING Inc. NHIServiSignAdapter Windows Versions - Stack Overflow

Published Dec 31, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 1.98%

Description

The digest generation function of NHIServiSignAdapter has not been verified for parameter’s length, which leads to a stack overflow loophole. Remote attackers can use the leak to execute code without privilege.

Affected products

Vendor CHANGING Inc. Product NHIServiSignAdapter Default
unknown
Affected
- 1.0.20.0218

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
CHANGING Inc.	NHIServiSignAdapter	unknown	Affected 1.0.20.0218

Remediation

Vendor solution

Update to version 1.0.20.1109

Weaknesses (2)

CWE-121

CWE-787

Out-of-bounds Write

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18477
Advisory
https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-18477		Advisory
https://www.twcert.org.tw/tw/cp-132-4272-23ba4-1.html		x_refsource_MISCThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner twcert

Published Dec 31, 2020

Updated Sep 16, 2024

Reserved Sep 23, 2020

Link CVE-2020-25844

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-25844

Red Hat

No data

ENISA EUVD

Assigner twcert

Published Dec 31, 2020

Updated Sep 16, 2024

Link EUVD-2020-18477

GitHub

No data