Vulnerability · Published Jul 16, 2020 · Assigned by icscert

CVE-2020-12009

High 7.5

In plain English

A high-severity unsafe deserialization in GenBroker32 from ICONICS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)3.6%top 10.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric	MC Works64	4.02C (10.95.208.31) and earlierall versions
Mitsubishi Electric	MC Works32	Version 3.00A (9.50.255.02)
ICONICS	GenBroker64, Platform Services, Workbench, FrameWorX Server	v10.96 and prior
ICONICS	GenBroker32	v9.5 and prior

Weakness: CWE-502

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 x_refsource_CONFIRM
https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 x_refsource_CONFIRM