Vulnerability · Published Jul 16, 2020 · Assigned by icscert

CVE-2020-12007

Critical 9.8

In plain English

A critical-severity unsafe deserialization in GenBroker32 from ICONICS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)3.9%top 9.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric	MC Works64	Version 4.02C (10.95.208.31) and earlierall versions
Mitsubishi Electric	MC Works32	Version 3.00A (9.50.255.02)
ICONICS	GenBroker64, Platform Services, Workbench, FrameWorX Server	v10.96 and prior
ICONICS	GenBroker32	v9.5 and prior

Weakness: CWE-502

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 x_refsource_CONFIRM
https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C x_refsource_CONFIRM