CVSS: 7.8EPSS: 0%CPEs: 47EXPL: 0CVE-2021-27041 – ICONICS GENESIS64 DWG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-27041
A maliciously crafted DWG file can be used to write beyond the allocated buffer while parsing DWG files. This vulnerability can be exploited to execute arbitrary code Un archivo DWG malicioso puede ser utilizado para escribir más allá del buffer asignado mientras se analizan los archivos DWG. Esta vulnerabilidad puede ser explotada para ejecutar código arbitrario This vulnerability allows remote attackers to execute arbitrary code on affected installations of ICONICS GENESIS64. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated data structure. • https://www.autodesk.com/trust/security-advisories/adsk-sa-2022-0007 • CWE-787: Out-of-bounds Write •
CVSS: 4.3EPSS: 0%CPEs: 43EXPL: 0CVE-2021-27040 – ICONICS GENESIS64 DWG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2021-27040
A maliciously crafted DWG file can be forced to read beyond allocated boundaries when parsing the DWG file. This vulnerability can be exploited to execute arbitrary code. Un archivo DWG diseñado maliciosamente puede ser forzado a leer más allá de los límites asignados al analizar el archivo DWG. Esta vulnerabilidad puede ser explotada para ejecutar código arbitrario This vulnerability allows remote attackers to disclose sensitive information on affected installations of ICONICS GENESIS64. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. • https://www.autodesk.com/trust/security-advisories/adsk-sa-2021-0004 https://www.zerodayinitiative.com/advisories/ZDI-21-1236 https://www.zerodayinitiative.com/advisories/ZDI-21-1238 https://www.zerodayinitiative.com/advisories/ZDI-22-378 https://www.zerodayinitiative.com/advisories/ZDI-22-473 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 2%CPEs: 11EXPL: 0CVE-2020-12007 – ICONICS Genesis64 fwxserver Deserialization Denial-Of-Service Vulnerability
https://notcve.org/view.php?id=CVE-2020-12007
A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior. Un paquete de comunicación especialmente diseñado enviado a los dispositivos afectados podría permitir una ejecución de código remota y una condición de denegación de servicio debido a una vulnerabilidad de deserialización. Este problema afecta: Mitsubishi Electric MC Works64 versión 4.02C (10.95.208.31) y anteriores, todas las versiones; Mitsubishi Electric MC Works32 versión 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versión 10.96 y anteriores; ICONICS GenBroker32 versión 9.5 y anteriores This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of ICONICS Genesis64. Authentication is not required to exploit this vulnerability. The specific flaw exists with the handling of serialized objects. • https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2020-12009 – ICONICS Genesis64 PKGX WbPackAndGoSettings Absolute Path Traversal Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12009
A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior. Un paquete de comunicación especialmente diseñado enviado al dispositivo afectado podría causar una condición de denegación de servicio debido a una vulnerabilidad de deserialización. Esto afecta: Mitsubishi Electric MC Works64 versión 4.02C (10.95.208.31) y anteriores, todas las versiones; Mitsubishi Electric MC Works32 versión 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versión v10.96 y anteriores; ICONICS GenBroker32 versión v9.5 y anteriores The vulnerablity allows remote attackers to execute arbitrary code on affected installations of ICONICS Genesis64. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of PKGX files. • https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2020-12015 – ICONICS Genesis64 IcoFwxServer Deserialization Of Untrusted Data Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12015
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior. Un paquete de comunicación especialmente diseñado enviado a los sistemas afectados podría causar una condición de denegación de servicio debido a una deserialización inapropiada. Este problema afecta: Mitsubishi Electric MC Works64 versión 4.02C (10.95.208.31) y anteriores, todas las versiones; Mitsubishi Electric MC Works32 versión 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versión v10.96 y anteriores; ICONICS GenBroker32 versión 9.5 y anteriores This vulnerability allows remote attackers to execute arbitrary code on affected installations of ICONICS Genesis64. Authentication is not required to exploit this vulnerability. The specific flaw exists with the handling of serialized objects. • https://www.us-cert.gov/ics/advisories/icsa-20-170-02 https://www.us-cert.gov/ics/advisories/icsa-20-170-03 • CWE-502: Deserialization of Untrusted Data •