Read the docs
TI-2020-06368 Aliases CVE-2020-7863GHSA-5pwr-5jq4-6w5f

Raonwiz RAON K Upload Arbitrary Command Execution Vulnerability

Priority MEDIUM 41CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability in File Transfer Solution of Raonwiz could allow arbitrary command execution as the result of viewing a specially-crafted web page. This vulnerability is due to insufficient validation of the parameter of the specific method. An attacker could exploit this vulnerability by setting the parameter to the command they want to execute. A successful exploit could allow the attacker to execute arbitrary commands on a target system as the user. However, the victim must run the Internet Explorer browser with administrator privileges because of the cross-domain policy.

Why it matters now

EPSS 0.01477 74th percentileScored 2026-11-07
Fix Fixed RAON K Upload (Raonwiz,inc): 2018.0.2.56

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RAONWIZRAON K Upload2018.0.2.55 to before 2018.0.2.562018.0.2.56Patch availableCNA
  • RAON K Upload VendorRAONWIZ Affected 2018.0.2.55 to before 2018.0.2.56 Fixed in 2018.0.2.56 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:raonwiz:raon_k_upload:*:*:*:*:*:*:*:*before 2018.0.2.56VulnerableRAONWIZ
  • cpe:2.3:a:raonwiz:raon_k_upload:*:*:*:*:*:*:*:* Versions before 2018.0.2.56 Vulnerable ·RAONWIZ

Remediation

  • Fix · CNA RAON K Upload (Raonwiz,inc) Fixed in 2018.0.2.56

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-7863
  2. 2026-10-03 Alias added: GHSA-5pwr-5jq4-6w5f

References

Advisory 2

  • TI-2020-06328 Improper input validation in RAONWIZ RAON KUpload CVSS 3.1CRITICAL 9.8
  • TI-2020-06322 RAONWIZ Inc K Upload, arguments modiffication via missing support for integrity check vulnerability CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences