Vulnerability · Published Jul 16, 2020 · Assigned by icscert
CVE-2020-12011
Critical 9.8
In plain English
A critical-severity out-of-bounds write in GenBroker32. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 29.2% (higher than 98% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)29.2%top 1.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Mitsubishi Electric MC Works64 | Version 4.02C (10.95.208.31) and earlierall versions |
| n/a | MC Works32 | Version 3.00A (9.50.255.02) |
| n/a | ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server | v10.96 and prior |
| n/a | GenBroker32 | v9.5 and prior |
Weakness: CWE-787
References
- https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 x_refsource_MISC
- https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 x_refsource_MISC