Security readout for executives and security teams
Plain-English summary
This vulnerability affects Innorix file transfer client software and can let an attacker trick a user into opening a crafted web page that downloads and runs a remote file. The business risk is malware infection or compromise of a workstation using the affected agent.
Executive priority
Treat as high priority for environments using Innorix file transfer. The impact is potentially full workstation compromise, but urgency should be based on confirmed deployment and vendor version guidance because the provided sources do not establish active exploitation.
Technical view
The issue is described as CWE-88 argument injection in the Innorix web-based file transfer solution/INNORIX Agent.exe. Controlled arguments to an internal method may cause remote file download and execution. CVSS 3.1 is 7.8, with user interaction required and high confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely on managed endpoints where INNORIX Agent.exe or the Innorix web-based file transfer solution is installed. The source bundle has version ambiguity: the description says prior to and including 9.2.18.385, while the affected entry lists 9.2.18.390.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The described attack requires user interaction: a remote attacker induces a user to visit a crafted web page. Impact may include malicious code infection on the affected endpoint.
Researcher notes
Evidence is sufficient for vulnerability existence and impact but incomplete on exact fixed version and exploit prevalence. Preserve the version discrepancy when tracking exposure, and avoid assuming products beyond Innorix web-based file transfer solution and INNORIX Agent.exe.
Mitigation direction
- Inventory endpoints for INNORIX Agent.exe and Innorix file transfer components.
- Check INNORIX and KRCERT guidance for confirmed fixed versions or vendor remediation.
- Remove or disable the agent where there is no business requirement.
- Prioritize remediation on systems used for sensitive file transfer workflows.
- Use endpoint controls to limit untrusted file execution where feasible.
Validation and detection
- Confirm installed INNORIX Agent.exe versions across managed endpoints.
- Compare discovered versions against vendor and KRCERT advisories.
- Review endpoint telemetry for unexpected INNORIX-launched downloads or executions.
- Verify affected users cannot use obsolete agent versions after remediation.
- Document any version uncertainty for vendor clarification.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-88: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-7851 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H1.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35984CVE reference · x_refsource_MISC
- https://www.innorix.com/ko/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.