Paper/Archive/CVE-2020-12007

CVE-2020-12007

Mitsubishi Electric MC Works64 — A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition…

EPSS 4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 90.4.904 × 2018.1 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.

Affected

ProductAffectedFixed inSource

MC Works64Version 4.02C (10.95.208.31) and earlier–CNA

MC Works64all versions–CNA

MC Works32Version 3.00A (9.50.255.02)–CNA

GenBroker64, Platform Services, Workbench, FrameWorX Serverv10.96 and prior–CNA

GenBroker32v9.5 and prior–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refus-cert.cisa.gov/ics/advisories/icsa-20-170-03 refus-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C