CVE-2020-3925: 
ServiSign vulnerability analysis and mitigation

A Remote Code Execution (RCE) vulnerability exists in some designated applications in ServiSign security plugin (CVE-2020-3925). The vulnerability was discovered in December 2019 and affects ServiSign, a cross-platform digital signature and verification system developed by Changingtec in Taiwan (CHT Security).

The vulnerability exists due to an insecure function call LoadLibraryA in the DLL file of ServiSign. The function lacks proper filtering or restrictions on parameters when reading DLL files in high-privilege directories, allowing attackers to control the path parameter to execute malicious DLL files. The vulnerability affects ServiSign for Windows version 1.0.19.0617 and earlier (CHT Security).

Without proper path filtering or access control, attackers can execute malicious DLL files on the target computer through these weak functions without authentication. This can be achieved by injecting malicious Javascript code via XSS payloads in phishing websites (CHT Security).

Users should upgrade to versions newer than ServiSign for Windows 1.0.19.0617 to mitigate this vulnerability (CHT Security).