CVE-2020-14030

HIGH

Ozeki NG SMS Gateway < 4.17.6 - Remote Code Execution via .NET Deserialization

Title source: llm

Description

An issue was discovered in Ozeki NG SMS Gateway through 4.17.6. It stores SMS messages in .NET serialized format on the filesystem. By generating (and writing to the disk) malicious .NET serialized files, an attacker can trick the product into deserializing them, resulting in arbitrary code execution.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_misc

http://www.ozeki.hu/index.php?owpn=231

Patch, Third Party Advisory x_refsource_misc

https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14030-RCE%20via%20.NET%20Deserialization-Ozeki%20SMS%20Gateway

Scores

CVSS v3 7.2

EPSS 0.0184

EPSS Percentile 76.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-502

Status published

Products (1)

ozeki/ozeki_ng_sms_gateway < 4.17.6

Published Sep 30, 2020

Tracked Since Feb 18, 2026