CVE-2020-24837 describes an integer underflow vulnerability in the ZCFees project's zcfees component. Specifically, the subtraction of two unsigned integers, 'currPeriodIdx' and 'lastPeriodExecIdx', can result in a negative value, leading to an underflow. This flaw allows attackers to manipulate transaction timestamps, effectively blocking the execution of the process function. The vulnerability carries a CVSS score of 7.5 (HIGH), indicating a significant risk. It is remotely exploitable with low attack complexity, requiring no user interaction or privileges, and could lead to a high impact on integrity (A:N, I:H, C:N). Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has received minimal community discussion and media coverage, suggesting a low level of public awareness or attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:zcfees_project:zcfees:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.