What’s Vulnerable › Vulnerabilities

CVE-2020-7847

• Severity: high (CVSS 8.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-23 · updated 2026-06-17
• Weakness: CWE-434

Description

The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature, which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.

Affected products

• Iptime Nas-I Firmware: before 1.4.36 — fixed in 1.4.36
• Iptime Nas-Ii Firmware: before 1.4.36 — fixed in 1.4.36
• Iptime Nas-Iie Firmware: before 1.4.36 — fixed in 1.4.36
• Iptime Nas101 Firmware: before 1.4.36 — fixed in 1.4.36
• Iptime Nas1Dual Firmware: before 1.4.36 — fixed in 1.4.36
• Iptime Nas2Dual Firmware: before 1.4.36 — fixed in 1.4.36
• Iptime Nas3 Firmware: before 1.4.36 — fixed in 1.4.36
• Iptime Nas4 Firmware: before 1.4.36 — fixed in 1.4.36
• Iptime Nas4Dual Firmware: before 1.4.36 — fixed in 1.4.36

How to fix

Upgrade to a fixed version: Iptime Nas-I Firmware 1.4.36; Iptime Nas-Ii Firmware 1.4.36; Iptime Nas-Iie Firmware 1.4.36; Iptime Nas101 Firmware 1.4.36; Iptime Nas1Dual Firmware 1.4.36; Iptime Nas2Dual Firmware 1.4.36; Iptime Nas3 Firmware 1.4.36; Iptime Nas4 Firmware 1.4.36; Iptime Nas4Dual Firmware 1.4.36. Check the vendor advisory for mitigations.

References

• https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35921
• https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35921

Get alerted when CVE-2020-7847 or the next vulnerability affects your stack