CVE-2020-7813 : Security Advisory and Response

Ezhttptrans.ocx ActiveX Control in Kaoni ezHTTPTrans 1.0.0.70 and prior versions contain a vulnerability that could allow a remote attacker to download and execute arbitrary files.

Understanding CVE-2020-7813

This CVE involves a vulnerability in the ActiveX Control of Kaoni's ezHTTPTrans software that enables remote attackers to execute malicious code.

What is CVE-2020-7813?

The vulnerability in the ActiveX Control of Kaoni's ezHTTPTrans software allows attackers to download and execute arbitrary files by manipulating the arguments of the ActiveX method.

The Impact of CVE-2020-7813

CVSS Base Score: 7.8 (High Severity)
Attack Vector: Local
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High

Technical Details of CVE-2020-7813

This section provides more technical insights into the vulnerability.

Vulnerability Description

The vulnerability in ezHTTPTrans allows remote attackers to download and execute arbitrary files by manipulating ActiveX method arguments.

Affected Systems and Versions

Affected Product: ezHTTPTrans
Vendor: Kaoni
Affected Version: 1.0.0.70 and prior (<= 1.0.0.70)

Exploitation Mechanism

Attackers can exploit this vulnerability by setting specific arguments to the ActiveX method, enabling them to download and execute malicious files.

Mitigation and Prevention

To address CVE-2020-7813, follow these mitigation strategies:

Immediate Steps to Take

Disable the ActiveX control in the affected software.
Implement network segmentation to limit exposure.
Monitor and filter ActiveX controls in use.

Long-Term Security Practices

Regularly update software and apply security patches.
Conduct security training to educate users on safe practices.

Patching and Updates

Apply the latest patches and updates provided by Kaoni to fix the vulnerability.