PT-2020-4197 · Mitsubishi+1 · Mc Works64+6
Ali Abbasi
+8
·
Published
2020-06-30
·
Updated
2020-07-22
·
CVE-2020-12015
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier
Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02)
ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior
ICONICS GenBroker32 version 9.5 and prior
Description:
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. The issue is related to deficiencies in the deserialization mechanism, which can be exploited by a remote attacker to cause a denial-of-service condition.
Recommendations:
For Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, update to a version that fixes the deserialization issue.
For Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02), update to a version that fixes the deserialization issue.
For ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior, update to a version that fixes the deserialization issue.
For ICONICS GenBroker32 version 9.5 and prior, update to a version that fixes the deserialization issue.
As a temporary workaround, consider restricting access to the deserialization mechanism until a patch is available.
Fix
Deserialization of Untrusted Data
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Frameworx Server
Genbroker32
Genbroker64
Mc Works32
Mc Works64
Platform Services
Workbench