Paper/Archive/CVE-2020-12013

CVE-2020-12013

Mitsubishi Electric MC Works64 — A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely.

EPSS 3%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 87.5.875 × 2017.5 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.

Affected

ProductAffectedFixed inSource

MC Works64Version 4.02C (10.95.208.31) and earlier–CNA

MC Works64all versions–CNA

MC Works32Version 3.00A (9.50.255.02)–CNA

GenBroker64, Platform Services, Workbench, FrameWorX Serverv10.96 and prior–CNA

GenBroker32v9.5 and prior–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References

refus-cert.cisa.gov/ics/advisories/icsa-20-170-02 refus-cert.cisa.gov/ics/advisories/icsa-20-170-03