High severity8.8NVD Advisory· Published Sep 9, 2021· Updated Jun 17, 2026

CVE-2020-7874

Description

Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension.

Affected products

Tobesoft/Nexacro
cpe:2.3:a:tobesoft:nexacro:*:*:*:*:*:*:*:*
Range: >=14.0.0.0,<14.0.1.3600
Tobesoft/NEXACRO14 Runtime ActiveXllm-fuzzy
Tobesoft/Nexacro14v5
Range: 14.0.1.3600

Patches

Vulnerability mechanics

References

www.boho.or.kr/krcert/secNoticeView.donvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000