Vulnerability · Published Jul 16, 2020 · Assigned by icscert

CVE-2020-12015

High 7.5

In plain English

A high-severity unsafe deserialization in GenBroker32 from ICONICS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS NVD)7.5High

Exploit odds (30 days)2.0%top 18.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.

Affected products (as reported)

Vendor	Product	Versions
Mitsubishi Electric	MC Works64	version 4.02C (10.95.208.31) and earlierall versions
Mitsubishi Electric	MC Works32	version 3.00A (9.50.255.02)
ICONICS	GenBroker64, Platform Services, Workbench, FrameWorX Server	version 10.96 and prior
ICONICS	GenBroker32	version 9.5 and prior

Weakness: CWE-502

References

https://www.us-cert.gov/ics/advisories/icsa-20-170-03 x_refsource_CONFIRM
https://www.us-cert.gov/ics/advisories/icsa-20-170-02 x_refsource_CONFIRM