Vulnerability · Published Jul 16, 2020 · Assigned by icscert
CVE-2020-12013
Critical 9.1
In plain English
A critical-severity code injection in GenBroker32 from ICONICS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities).
Severity (CVSS NVD)9.1Critical
Exploit odds (30 days)3.0%top 12.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mitsubishi Electric | MC Works64 | Version 4.02C (10.95.208.31) and earlierall versions |
| Mitsubishi Electric | MC Works32 | Version 3.00A (9.50.255.02) |
| ICONICS | GenBroker64, Platform Services, Workbench, FrameWorX Server | v10.96 and prior |
| ICONICS | GenBroker32 | v9.5 and prior |
Weakness: CWE-94
References
- https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 x_refsource_CONFIRM
- https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 x_refsource_CONFIRM