{"id":"CVE-2020-7838","aliases":["EUVD-2020-28770","GHSA-q53r-4p37-g26v"],"status":"published","title":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly...","description":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0125,"percentile":0.69768,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2020-12-18T00:04:31Z","modified":"2026-06-17T03:25:32Z","products":[{"vendor":"onstove","product":"stove"},{"vendor":"smilegate","product":"stove client"}],"references":[{"url":"https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35851","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7838"},{"url":"https://github.com/advisories/GHSA-q53r-4p37-g26v"}],"sources":{"cve":[{"id":"CVE-2020-7838","description":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.","status":"published","published":"2020-12-18T00:04:31Z","modified":"2024-08-04T09:41:01.896Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:35:58.787905Z"}],"euvd":[{"id":"EUVD-2020-28770","description":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.","status":"published","published":"2020-12-18T00:04:31Z","modified":"2024-08-04T09:41:01Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:07:59.058668Z"}],"ghsa":[{"id":"GHSA-q53r-4p37-g26v","title":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly...","description":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.","status":"published","published":"2022-05-24T17:36:57Z","modified":"2023-01-29T05:05:47Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:45:52.34362Z"}],"nvd":[{"id":"CVE-2020-7838","description":"A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.","status":"published","published":"2020-12-18T01:15:12.713Z","modified":"2026-06-17T03:25:32.017Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:06:27.73474Z"}]}}