Read the docs
TI-2020-15841 Aliases CVE-2020-25850GHSA-wv77-666p-gm5q

HGiga MailSherlock - Arbitrary File Download

Priority LOW 37Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The function, view the source code, of HGiga MailSherlock does not validate specific characters. Remote attackers can use this flaw to download arbitrary system files.

Why it matters now

EPSS 0.01121 66th percentileScored 2026-11-07
Fix Fixed MailSherlock MSR45/SSR45 (HGiga): 117

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
HGigaMailSherlock MSR45/SSR45before 117117Patch availableCNA
  • MailSherlock MSR45/SSR45 VendorHGiga Affected before 117 Fixed in 117 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:*before 4.5-117VulnerableHGiga
cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:*before 4.5-117VulnerableHGiga
  • cpe:2.3:a:hgiga:msr45_isherlock-user:*:*:*:*:*:*:*:* Versions before 4.5-117 Vulnerable ·HGiga
  • cpe:2.3:a:hgiga:ssr45_isherlock-user:*:*:*:*:*:*:*:* Versions before 4.5-117 Vulnerable ·HGiga

Remediation

  • Fix · CNA MailSherlock MSR45/SSR45 (HGiga) Fixed in 117

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-25850
  2. 2026-10-03 Alias added: GHSA-wv77-666p-gm5q

References

Advisory 1

  • TI-2020-18295 HGiga MailSherlock - Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2020-15839 HGiga MailSherlock - Broken Authentication CVSS 3.1CRITICAL 9.8
  • TI-2021-05709 HGiga MailSherlock - SQL Injection-2 CVSS 3.1CRITICAL 9.8
  • TI-2019-07262 Cross-site request forgery in HGiga MailSherlock MSR35 CVSS 3.0HIGH 8.8
  • TI-2019-07261 Cross-site request forgery in HGiga MailSherlock MSR35 CVSS 3.0HIGH 8.8
  • TI-2020-18199 HGiga MailSherlock - SQL Injection -3 CVSS 3.1HIGH 7.6
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences