Sogou Input Method SGTool downloads files over HTTP, allowing code execution
Windows users of this Chinese input app can be hacked.
Summary
SGTool.exe in Sogou Input Method fetches its configuration over unencrypted HTTP, so an attacker who can manipulate network traffic can make it download malicious files. Sogou Input Method for Windows is affected.
Affected when
- Sogou Input Method for Windows
- attacker able to manipulate network traffic
What to do
Update Sogou Input Method to version 16.10 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen