Every CVESearch/Get API key

CVE-2020-36245

GramAddict bot uses dependency with reverse tcp backdoor

8.8 HighFix available

GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.57%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used8.8

GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

Record
CVE-2020-36245
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
5.8 MediumAV:A/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-306
Updated
2026-11-02
CVE ListNo score

GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

Record
CVE-2020-36245
Updated
2026-11-02
EUVDEUVD-2021-0096No score

GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

Record
EUVD-2021-0096
Updated
2026-11-03
GitHub AdvisoriesGHSA-q5h6-49gg-2wfg8.7

GramAddict bot uses dependency with reverse tcp backdoor

GramAddict before 1.2.5 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

Record
GHSA-q5h6-49gg-2wfg
CVSS 4.0
8.7 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94, CWE-306
Updated
2026-11-02
OSV8.8

GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

Record
CVE-2020-36245
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-q5h6-49gg-2wfg8.7

GramAddict bot uses dependency with reverse tcp backdoor

GramAddict before 1.2.5 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

Record
GHSA-q5h6-49gg-2wfg
CVSS 4.0
8.7 HighCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306, CWE-94
Updated
2026-11-02
OSVPYSEC-2021-65No score

GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.

Record
PYSEC-2021-65
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gramaddict
PyPI
before 1.2.5
1.2.5
gramaddict
PyPI
before 1.2.5, plus listed versions
1.2.01.2.0b11.2.0b21.2.0b31.2.11.2.21.2.31.2.4
1.2.5
gramaddict
PyPI
before 1.2.4, plus listed versions
1.2.01.2.0b11.2.0b21.2.0b31.2.11.2.21.2.3
1.2.4

History

History
RecordedChangedSources
facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-36245 is a high vulnerability (CVSS 8.8) in Gramaddict, published February 17, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in gramaddict 1.2.5.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open