CVE-2020-14025 describes multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Ozeki NG SMS Gateway versions up to 4.17.6. An attacker could trick an authenticated administrator into clicking a malicious link, leading to unauthorized actions such as installing new modules or changing passwords. This vulnerability carries a high CVSS score of 8.8, indicating a severe impact with high confidentiality, integrity, and availability risks, requiring user interaction but no special privileges. While no public exploits or active exploitation have been observed, and community discussion is minimal, the potential for significant unauthorized changes warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.17.6CPE matchmatch criteria | cpe:2.3:a:ozeki:ozeki_ng_sms_gateway:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.