PT-2020-4303 · Arc Informatique · Pcvue

Published 2020-10-12 · Updated 2022-10-19 · CVE-2020-26867

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: ARC Informatique PcVue versions prior to 12.0.17

Description: The issue is related to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server. This is due to weaknesses in the deserialization mechanism.

Recommendations: For versions prior to 12.0.17, update to version 12.0.17 or later to resolve the issue. As a temporary workaround, consider restricting access to the deserialization mechanism to minimize the risk of exploitation.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2020-04796

CVE-2020-26867

Affected Products

Pcvue

References · 9

• https://pcvuesolutions.com/security · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26867 · Security Note
• https://pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04796 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26867 · Vendor Advisory
• https://t.me/cvenotify/7279 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03 · Note
• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue · Note
• https://t.me/cvenotify/7392 · Telegram Post