CVE-2020-12007
Critical
Description
A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.
SeverityCritical
CVSS9.8
Exploit probability—
ProductMitsubishielectric Mc Works
PublishedJul 16, 2020
First seenJul 16, 2020
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mitsubishielectric mc_works | v ≤ 10.95.208.31 | — |
| mitsubishielectric mc_works32 | 9.50.255.02 | — |
| iconics energy_analytix | No range specified | — |
| iconics facility_analytix | No range specified | — |
| iconics genesis64 | No range specified | — |
| iconics hyper_historian | No range specified | — |
| iconics mobilehmi | No range specified | — |
| iconics quality_analytix | No range specified | — |
| iconics smart_energy_analytix | No range specified | — |
| iconics bizviz | No range specified | — |
| iconics genesis32 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.