CVE-2020-8644criticalunder attackCWE-94

CVE-2020-8644

Published · Updated

Follow this CVE+ Monitor playSMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 86%
from disclosure to weapon71 days
Published on NVDFeb 5
1st PoC+71d
metasploitFeb 5
CISA KEV+637d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

PlaySMS versions before 1.4.3 fail to properly clean user inputs, allowing attackers to inject and execute malicious code. This can lead to complete system compromise.

Technical detail

CWE-94 (Code Injection) vulnerability in PlaySMS <1.4.3 due to insufficient input sanitization. An attacker can inject arbitrary code through unsanitized input parameters, potentially achieving remote code execution with system-level privileges. Pre-condition: access to input vectors (e.g., web forms, API endpoints); impact includes data theft, system takeover, and lateral movement.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

PlaySMS before 1.4.3 does not sanitize inputs from a malicious string.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.