CVE-2020-12775

9.8 criticalEPSS 2.8%

Critical (9.8) in moica hicos. EPSS 2.8% chance of exploitation in the next 30 days.

Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system command, disrupt system or terminate service.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.8% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2022-03-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

moica:hicos

References

https://moica.nat.gov.tw/rac_plugin.html
https://www.twcert.org.tw/tw/cp-132-5695-421a7-1.html
https://moica.nat.gov.tw/rac_plugin.html
https://www.twcert.org.tw/tw/cp-132-5695-421a7-1.html

Check your stack JSON