CVE-2020-7874: NEXACRO14 Runtime arbitrary file download and execution vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-09-09 · updated 2026-06-17
Weakness: CWE-494

Description

Download of code without integrity check vulnerability in NEXACRO14 Runtime ActiveX control of tobesoft Co., Ltd allows the attacker to cause an arbitrary file download and execution. This vulnerability is due to incomplete validation of file download URL or file extension.

Affected products

TOBESOFT NEXACRO17: from 14.0.0.0 before 14.0.1.3600 — fixed in 14.0.1.3600

How to fix

Upgrade to a fixed version: TOBESOFT NEXACRO17 14.0.1.3600. Check the vendor advisory for mitigations.

References

https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36235
https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=36235

Get alerted when CVE-2020-7874 or the next vulnerability affects your stack