CVE-2020-7874 describes a critical vulnerability in the NEXACRO14 Runtime ActiveX control used by tobesoft Co., Ltd products, including NEXACRO for Microsoft Windows. This flaw allows an attacker to download and execute arbitrary files due to insufficient integrity checks on download URLs or file extensions. With a CVSS score of 8.8 (HIGH), this vulnerability presents a significant risk, as it can be exploited remotely with low attack complexity, potentially leading to complete compromise of confidentiality, integrity, and availability. While no public exploits, Metasploit modules, or Nuclei templates are currently available, and there's no evidence of active exploitation or significant community discussion, the high severity warrants attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 14.0.0.0, < 14.0.1.3600CPE matchmatch criteria | cpe:2.3:a:tobesoft:nexacro:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.
Remediation records are not available for this CVE.