{"id":"CVE-2020-36245","aliases":["EUVD-2021-0096","GHSA-q5h6-49gg-2wfg","PYSEC-2021-65"],"status":"published","title":"GramAddict bot uses dependency with reverse tcp backdoor","description":"GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01573,"percentile":0.75773,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306","CWE-94"],"published":"2021-02-17T21:49:12Z","modified":"2026-10-20T10:54:21Z","fixes":[{"ecosystem":"PyPI","package":"gramaddict","fixed_in":["1.2.5","1.2.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"gramaddict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"gramaddict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5"}]}],"versions":["1.2.0","1.2.0b1","1.2.0b2","1.2.0b3","1.2.1","1.2.2","1.2.3","1.2.4"]},{"source":"osv","ecosystem":"PyPI","package":"gramaddict","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.4"}]}],"versions":["1.2.0","1.2.0b1","1.2.0b2","1.2.0b3","1.2.1","1.2.2","1.2.3"]}],"products":[{"vendor":"gramaddict","product":"gramaddict"}],"references":[{"url":"https://github.com/GramAddict/bot/issues/134","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-36245","tags":["advisory"]},{"url":"https://github.com/GramAddict/bot/pull/183","tags":["web"]},{"url":"https://github.com/GramAddict/bot/commit/b9d11691b2fb13749c3cd0f75c70ee31242053ce","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/gramaddict/PYSEC-2021-65.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q5h6-49gg-2wfg","tags":["advisory"]},{"url":"https://github.com/GramAddict/bot","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-36245","description":"GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.","status":"published","published":"2021-02-17T21:49:12Z","modified":"2024-08-04T17:23:09.996Z","updated_at":"2026-11-02T14:35:54.80237Z"}],"euvd":[{"id":"EUVD-2021-0096","description":"GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.","status":"published","published":"2021-02-17T21:49:12Z","modified":"2024-08-04T17:23:09Z","updated_at":"2026-11-03T03:07:04.065361Z"}],"ghsa":[{"id":"GHSA-q5h6-49gg-2wfg","title":"GramAddict bot uses dependency with reverse tcp backdoor","description":"GramAddict before 1.2.5 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.","status":"published","published":"2022-05-24T17:42:31Z","modified":"2024-09-20T21:46:41Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-94","CWE-306"],"updated_at":"2026-11-02T14:38:05.526697Z"}],"nvd":[{"id":"CVE-2020-36245","description":"GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.","status":"published","published":"2021-02-17T22:15:12.633Z","modified":"2026-06-17T03:15:12.203Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:A/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:06:34.188486Z"}],"osv":[{"id":"CVE-2020-36245","description":"GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.","status":"published","published":"2021-02-17T22:15:12.633Z","modified":"2026-10-20T10:54:21.049100912Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.612899Z"},{"id":"GHSA-q5h6-49gg-2wfg","title":"GramAddict bot uses dependency with reverse tcp backdoor","description":"GramAddict before 1.2.5 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.","status":"published","published":"2022-05-24T17:42:31Z","modified":"2024-09-20T22:02:39.23752Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-306","CWE-94"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"PYSEC-2021-65","description":"GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network.","status":"published","published":"2021-02-17T22:15:00Z","modified":"2026-06-10T17:01:50.491552547Z","updated_at":"2026-11-02T15:52:53.119977Z"}]}}