Sign-up

ID

VAR-202007-0205


CVE

CVE-2020-12007


TITLE

Mitsubishi Electric MC Works64 Code Issue Vulnerability

Trust: 1.0

sources: IVD: b28667ee-4b0f-4654-bd4f-fbb2c24c795a // IVD: 36556b9e-b308-4c4f-a8af-5fce9f89c31b // CNVD: CNVD-2020-34369

DESCRIPTION

A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior. Authentication is not required to exploit this vulnerability.The specific flaw exists with the handling of serialized objects. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Mitsubishi Electric MC Works64 is a set of data acquisition and monitoring system (SCADA) of Japan Mitsubishi Electric (Mitsubishi Electric) company. ** ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided

Trust: 2.52

sources: NVD: CVE-2020-12007 // ZDI: ZDI-20-776 // CNVD: CNVD-2020-34369 // IVD: b28667ee-4b0f-4654-bd4f-fbb2c24c795a // IVD: 36556b9e-b308-4c4f-a8af-5fce9f89c31b // VULMON: CVE-2020-12007

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.0

sources: IVD: b28667ee-4b0f-4654-bd4f-fbb2c24c795a // IVD: 36556b9e-b308-4c4f-a8af-5fce9f89c31b // CNVD: CNVD-2020-34369

AFFECTED PRODUCTS

vendor:mitsubishimodel:electric mc works64 <=4.02cscope:eqversion:(10.95.208.31)

Trust: 1.0

vendor:iconicsmodel:energy analytixscope:eqversion: -

Trust: 1.0

vendor:mitsubishielectricmodel:mc worksscope:lteversion:10.95.208.31

Trust: 1.0

vendor:iconicsmodel:mobilehmiscope:eqversion: -

Trust: 1.0

vendor:iconicsmodel:bizvizscope:eqversion: -

Trust: 1.0

vendor:iconicsmodel:facility analytixscope:eqversion: -

Trust: 1.0

vendor:mitsubishielectricmodel:mc works32scope:eqversion:9.50.255.02

Trust: 1.0

vendor:iconicsmodel:genesis64scope:eqversion: -

Trust: 1.0

vendor:iconicsmodel:genesis32scope:eqversion: -

Trust: 1.0

vendor:iconicsmodel:quality analytixscope:eqversion: -

Trust: 1.0

vendor:iconicsmodel:hyper historianscope:eqversion: -

Trust: 1.0

vendor:iconicsmodel:smart energy analytixscope:eqversion: -

Trust: 1.0

vendor:iconicsmodel:genesis64scope: - version: -

Trust: 0.7

sources: IVD: b28667ee-4b0f-4654-bd4f-fbb2c24c795a // IVD: 36556b9e-b308-4c4f-a8af-5fce9f89c31b // ZDI: ZDI-20-776 // CNVD: CNVD-2020-34369 // NVD: CVE-2020-12007

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-12007
value: CRITICAL

Trust: 1.0

ZDI: CVE-2020-12007
value: MEDIUM

Trust: 0.7

CNVD: CNVD-2020-34369
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202006-1227
value: CRITICAL

Trust: 0.6

IVD: b28667ee-4b0f-4654-bd4f-fbb2c24c795a
value: HIGH

Trust: 0.2

IVD: 36556b9e-b308-4c4f-a8af-5fce9f89c31b
value: HIGH

Trust: 0.2

VULMON: CVE-2020-12007
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-12007
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2020-34369
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: b28667ee-4b0f-4654-bd4f-fbb2c24c795a
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 36556b9e-b308-4c4f-a8af-5fce9f89c31b
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2020-12007
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2020-12007
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 1.4
version: 3.0

Trust: 0.7

sources: IVD: b28667ee-4b0f-4654-bd4f-fbb2c24c795a // IVD: 36556b9e-b308-4c4f-a8af-5fce9f89c31b // ZDI: ZDI-20-776 // CNVD: CNVD-2020-34369 // VULMON: CVE-2020-12007 // CNNVD: CNNVD-202006-1227 // NVD: CVE-2020-12007

PROBLEMTYPE DATA

problemtype:CWE-502

Trust: 1.0

sources: NVD: CVE-2020-12007

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202006-1227

TYPE

Code problem

Trust: 1.0

sources: IVD: b28667ee-4b0f-4654-bd4f-fbb2c24c795a // IVD: 36556b9e-b308-4c4f-a8af-5fce9f89c31b // CNNVD: CNNVD-202006-1227

PATCH

title:ICONICS has issued an update to correct this vulnerability.url:https://www.us-cert.gov/ics/advisories/icsa-20-170-03

Trust: 0.7

title:Patch for Mitsubishi Electric MC Works64 code issue vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/222941

Trust: 0.6

sources: ZDI: ZDI-20-776 // CNVD: CNVD-2020-34369

EXTERNAL IDS

db:NVDid:CVE-2020-12007

Trust: 3.4

db:ICS CERTid:ICSA-20-170-02

Trust: 2.3

db:ICS CERTid:ICSA-20-170-03

Trust: 1.7

db:ZDIid:ZDI-20-776

Trust: 1.3

db:CNVDid:CNVD-2020-34369

Trust: 1.0

db:CNNVDid:CNNVD-202006-1227

Trust: 1.0

db:ZDI_CANid:ZDI-CAN-10267

Trust: 0.7

db:AUSCERTid:ESB-2020.2147

Trust: 0.6

db:IVDid:B28667EE-4B0F-4654-BD4F-FBB2C24C795A

Trust: 0.2

db:IVDid:36556B9E-B308-4C4F-A8AF-5FCE9F89C31B

Trust: 0.2

db:VULMONid:CVE-2020-12007

Trust: 0.1

sources: IVD: b28667ee-4b0f-4654-bd4f-fbb2c24c795a // IVD: 36556b9e-b308-4c4f-a8af-5fce9f89c31b // ZDI: ZDI-20-776 // CNVD: CNVD-2020-34369 // VULMON: CVE-2020-12007 // CNNVD: CNNVD-202006-1227 // NVD: CVE-2020-12007

REFERENCES

url:https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03

Trust: 1.7

url:https://www.us-cert.gov/ics/advisories/icsa-20-170-02

Trust: 1.2

url:https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2c

Trust: 1.0

url:https://www.us-cert.gov/ics/advisories/icsa-20-170-03

Trust: 0.7

url:https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-12007

Trust: 0.6

url:https://www.zerodayinitiative.com/advisories/zdi-20-776/

Trust: 0.6

url:https://vigilance.fr/vulnerability/iconics-genesis32-genesis64-multiple-vulnerabilities-32668

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.2147/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/502.html

Trust: 0.1

url:https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02,

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/183626

Trust: 0.1

sources: ZDI: ZDI-20-776 // CNVD: CNVD-2020-34369 // VULMON: CVE-2020-12007 // CNNVD: CNNVD-202006-1227 // NVD: CVE-2020-12007

CREDITS

Yehuda Anikster of Claroty Research

Trust: 0.7

sources: ZDI: ZDI-20-776

SOURCES

db:IVDid:b28667ee-4b0f-4654-bd4f-fbb2c24c795a
db:IVDid:36556b9e-b308-4c4f-a8af-5fce9f89c31b
db:ZDIid:ZDI-20-776
db:CNVDid:CNVD-2020-34369
db:VULMONid:CVE-2020-12007
db:CNNVDid:CNNVD-202006-1227
db:NVDid:CVE-2020-12007

LAST UPDATE DATE

2024-11-23T22:11:26.672000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-20-776date:2020-06-30T00:00:00
db:CNVDid:CNVD-2020-34369date:2020-06-23T00:00:00
db:VULMONid:CVE-2020-12007date:2020-07-29T00:00:00
db:CNNVDid:CNNVD-202006-1227date:2020-07-30T00:00:00
db:NVDid:CVE-2020-12007date:2024-11-21T04:59:06.190

SOURCES RELEASE DATE

db:IVDid:b28667ee-4b0f-4654-bd4f-fbb2c24c795adate:2020-06-18T00:00:00
db:IVDid:36556b9e-b308-4c4f-a8af-5fce9f89c31bdate:2020-06-18T00:00:00
db:ZDIid:ZDI-20-776date:2020-06-30T00:00:00
db:CNVDid:CNVD-2020-34369date:2020-06-23T00:00:00
db:VULMONid:CVE-2020-12007date:2020-07-16T00:00:00
db:CNNVDid:CNNVD-202006-1227date:2020-06-18T00:00:00
db:NVDid:CVE-2020-12007date:2020-07-16T22:15:11.337