CVE-2020-12011
ICONICS Genesis64 VariantClear Out-Of-Bounds Access Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior.
Un paquete de comunicación especialmente diseñado enviado a los sistemas afectados podría causar una condición de denegación de servicio o permitir una ejecución de código remota. Este problema afecta: Mitsubishi Electric MC Works64 versión 4.02C (10.95.208.31) y anteriores, todas las versiones; MC Works32 versión 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versión 10.96 y anteriores; GenBroker32 versión 9.5 y anteriores
This vulnerability allows remote attackers to execute arbitrary code on affected installations of ICONICS Genesis64. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of indexes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-04-21 CVE Reserved
- 2020-06-30 CVE Published
- 2024-07-23 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-787: Out-of-bounds Write
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 | Third Party Advisory | |
| https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mitsubishielectric Search vendor "Mitsubishielectric" | Mc Works Search vendor "Mitsubishielectric" for product "Mc Works" | <= 10.95.208.31 Search vendor "Mitsubishielectric" for product "Mc Works" and version " <= 10.95.208.31" | - |
Affected
| ||||||
| Mitsubishielectric Search vendor "Mitsubishielectric" | Mc Works32 Search vendor "Mitsubishielectric" for product "Mc Works32" | 9.50.255.02 Search vendor "Mitsubishielectric" for product "Mc Works32" and version "9.50.255.02" | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Energy Analytix Search vendor "Iconics" for product "Energy Analytix" | - | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Facility Analytix Search vendor "Iconics" for product "Facility Analytix" | - | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Genesis64 Search vendor "Iconics" for product "Genesis64" | - | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Hyper Historian Search vendor "Iconics" for product "Hyper Historian" | - | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Mobilehmi Search vendor "Iconics" for product "Mobilehmi" | - | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Quality Analytix Search vendor "Iconics" for product "Quality Analytix" | - | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Smart Energy Analytix Search vendor "Iconics" for product "Smart Energy Analytix" | - | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Bizviz Search vendor "Iconics" for product "Bizviz" | - | - |
Affected
| ||||||
| Iconics Search vendor "Iconics" | Genesis32 Search vendor "Iconics" for product "Genesis32" | - | - |
Affected
| ||||||