CVE-2020-12007
CRITICAL EPSS 89.1%
Published Jul 16, 20205y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Published Jul 16, 2020 5y ago
Last Modified Jun 17, 2026 2w ago
Description
A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
89.1% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-502 Deserialization of Untrusted Data Validation
Affected Products 11
| Vendor | Product | Version | Range |
|---|---|---|---|
| mitsubishielectric | mc_works | * | ≤10.95.208.31 |
| mitsubishielectric | mc_works32 | 9.50.255.02 | any |
| iconics | energy_analytix | * | any |
| iconics | facility_analytix | * | any |
| iconics | genesis64 | * | any |
| iconics | hyper_historian | * | any |
| iconics | mobilehmi | * | any |
| iconics | quality_analytix | * | any |
| iconics | smart_energy_analytix | * | any |
| iconics | bizviz | * | any |
| iconics | genesis32 | * | any |
References 2
- us-cert.cisa.gov https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C
- us-cert.cisa.gov https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.