« Volver al listado

CVE-2020-25848

Estado: ModificadaCrítica (9.8)—

HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (10)

Hgiga — Msr45 Isherlock-antispamHgiga — Msr45 Isherlock-auditHgiga — Msr45 Isherlock-baseHgiga — Msr45 Isherlock-userHgiga — Msr45 Isherlock-useradminHgiga — Ssr45 Isherlock-antispamHgiga — Ssr45 Isherlock-auditHgiga — Ssr45 Isherlock-baseHgiga — Ssr45 Isherlock-userHgiga — Ssr45 Isherlock-useradmin

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-25848",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "twcert@cert.org.tw",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "twcert@cert.org.tw",
      "affectedData": [
        {
          "vendor": "HGiga",
          "product": "MailSherlock MSR45/SSR45",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "243",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iSherlock-base-4.5"
          ]
        },
        {
          "vendor": "HGiga",
          "product": "MailSherlock MSR45/SSR45",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "114",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iSherlock-user-4.5"
          ]
        },
        {
          "vendor": "HGiga",
          "product": "MailSherlock MSR45/SSR45",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "122",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iSherlock-useradmin-4.5"
          ]
        },
        {
          "vendor": "HGiga",
          "product": "MailSherlock MSR45/SSR45",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "143",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iSherlock-audit-4.5"
          ]
        },
        {
          "vendor": "HGiga",
          "product": "MailSherlock MSR45/SSR45",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "130",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "iSherlock-antispam-4.5"
          ]
        }
      ]
    }
  ],
  "published": "2020-12-31T08:15:13.410",
  "references": [
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "twcert@cert.org.tw"
    },
    {
      "url": "https://www.twcert.org.tw/tw/cp-132-4256-cfc5a-1.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "HGiga MailSherlock contains weak authentication flaw that attackers grant privilege remotely with default password generation mechanism."
    },
    {
      "lang": "es",
      "value": "HGiga MailSherlock contiene un fallo de autenticación débil que hace que atacantes otorguen privilegios remotamente con un mecanismo de generación de contraseña predeterminado."
    }
  ],
  "lastModified": "2026-06-17T03:07:23.303",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hgiga:msr45_isherlock-antispam:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D021936B-7017-4334-B287-1FF8B36A3856",
              "versionEndExcluding": "4.5-130"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:msr45_isherlock-audit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9422FF8B-F11E-43F1-924F-ED255FEA5D5D",
              "versionEndExcluding": "4.5-143"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:msr45_isherlock-base:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0318B74D-4EB8-4BF3-8A2C-2C228DFA8D78",
              "versionEndExcluding": "4.5-243"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "546B94BC-0169-470A-B7E4-583B75D353CA",
              "versionEndExcluding": "4.5-114"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:msr45_isherlock-useradmin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3149F56-8D50-4DBE-A399-8953FAEC801A",
              "versionEndExcluding": "4.5-122"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:ssr45_isherlock-antispam:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADD956BC-95E7-4153-8422-24EC09B98B3F",
              "versionEndExcluding": "4.5-130"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:ssr45_isherlock-audit:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D408B4EA-99EC-4DCF-868A-D543A9B99690",
              "versionEndExcluding": "4.5-143"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:ssr45_isherlock-base:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AB6EBE0-2D29-400A-B531-1BA980A0A4E0",
              "versionEndExcluding": "4.5-243"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52B8273D-6475-47CF-AF48-B9121C8D1B64",
              "versionEndExcluding": "4.5-114"
            },
            {
              "criteria": "cpe:2.3:a:hgiga:ssr45_isherlock-useradmin:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7954F87A-9249-4111-B720-9789EEE86D00",
              "versionEndExcluding": "4.5-112"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "twcert@cert.org.tw"
}