CVE-2020-14022

Ozeki NG SMS Gateway 4.17.1 through 4.17.6 does not check the file type when bulk importing new contacts ("Import Contacts" functionality) from a file. It is possible to upload an executable or .bat file that can be executed with the help of a functionality (E.g. the "Application Starter" module) within the application.

• CWE-434

• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14022-Dangerous%20File%20Upload-Ozeki%20SMS%20GatewayExploit, Third Party Advisory
• https://www.ozeki.hu/index.php?ow_page_number=1017&downloadaction=email&download_product_id=1&os=windows&dpath=%2Fattachments%2F702%2Finstallwindows_1590575794_OzekiNG-SMS-Gateway_4.17.6.zip&dname=Ozeki+NG+SMS+Gateway+v4.17.6&dsize=+%2817.8+MB%29&platform=WindowsRelease Notes, Vendor Advisory
• https://www.ozeki.hu/index.php?owpn=231Product, Vendor Advisory
• https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-14022-Dangerous%20File%20Upload-Ozeki%20SMS%20GatewayExploit, Third Party Advisory
• https://www.ozeki.hu/index.php?ow_page_number=1017&downloadaction=email&download_product_id=1&os=windows&dpath=%2Fattachments%2F702%2Finstallwindows_1590575794_OzekiNG-SMS-Gateway_4.17.6.zip&dname=Ozeki+NG+SMS+Gateway+v4.17.6&dsize=+%2817.8+MB%29&platform=WindowsRelease Notes, Vendor Advisory
• https://www.ozeki.hu/index.php?owpn=231Product, Vendor Advisory

Published

Sep 22, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14016An issue was discovered in Navigate CMS 2.9 r1433. The forgo…5.3
• CVE-2020-14017An issue was discovered in Navigate CMS 2.9 r1433. Sessions,…7.5
• CVE-2020-14018An issue was discovered in Navigate CMS 2.9 r1433. There is …6.1
• CVE-2020-14019Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for…7.8
• CVE-2020-1402An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-14021An issue was discovered in Ozeki NG SMS Gateway through 4.17…4.9
• CVE-2020-14023Ozeki NG SMS Gateway through 4.17.6 allows SSRF via SMS WCF …4.9
• CVE-2020-14024Ozeki NG SMS Gateway through 4.17.6 has multiple authenticat…6.1
• CVE-2020-14025Ozeki NG SMS Gateway through 4.17.6 has multiple CSRF vulner…8.8
• CVE-2020-14026CSV Injection (aka Excel Macro Injection or Formula Injectio…8.8
• CVE-2020-14027An issue was discovered in Ozeki NG SMS Gateway through 4.17…5.3
• CVE-2020-14028An issue was discovered in Ozeki NG SMS Gateway through 4.17…7.2