CVE-2020-13386

In SmartDraw 2020 27.0.0.0, the installer gives inherited write permissions to the Authenticated Users group on the SmartDraw 2020 installation folder. Additionally, when the product is installed, two scheduled tasks are created on the machine, SDMsgUpdate (Local) and SDMsgUpdate (TE). The scheduled tasks run in the context of the user who installed the product. Both scheduled tasks attempt to run the same binary, C:\SmartDraw 2020\Messages\SDNotify.exe. The folder Messages doesn't exist by default and (by extension) neither does SDNotify.exe. Due to the weak folder permissions, these can be created by any user. A malicious actor can therefore create a malicious SDNotify.exe binary, and have it automatically run, whenever the user who installed the product logs on to the machine. The malicious SDNotify.exe could, for example, create a new local administrator account on the machine.

• CWE-732

• https://improsec.com/tech-blog/how-not-do-handle-responsible-disclosure-smartdraw-2020Exploit, Third Party Advisory
• https://improsec.com/tech-blog/how-not-do-handle-responsible-disclosure-smartdraw-2020Exploit, Third Party Advisory

Published

May 27, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-1338<p>A remote code execution vulnerability exists in Microsoft…7.8
• CVE-2020-13380openSIS before 7.4 allows SQL Injection.9.8
• CVE-2020-13381openSIS through 7.4 allows SQL Injection.9.8
• CVE-2020-13382openSIS through 7.4 has Incorrect Access Control.9.1
• CVE-2020-13383openSIS through 7.4 allows Directory Traversal.7.5
• CVE-2020-13384Monstra CMS 3.0.4 allows remote authenticated users to uploa…8.8
• CVE-2020-13387Pexip Infinity before 23.4 has a lack of input validation, l…7.5
• CVE-2020-13388An exploitable vulnerability exists in the configuration-loa…9.8
• CVE-2020-13389An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi…9.8
• CVE-2020-1339A remote code execution vulnerability exists when Windows Me…7.8
• CVE-2020-13390An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi…9.8
• CVE-2020-13391An issue was discovered on Tenda AC6 V1.0 V15.03.05.19_multi…9.8