Lucene search

[email protected]CVE-2020-12013

HistoryJul 16, 2020 - 10:15 p.m.

CVE-2020-12013

2020-07-1622:15:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2020-12013

wcf client

mitsubishi electric

iconics

sql injection

remote code execution

nvd

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.5 High

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.004 Low

EPSS

Percentile

74.3%

JSON

A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.

CPENameOperatorVersion
mitsubishielectric:mc_works32mitsubishielectric mc works32eq9.50.255.02
mitsubishielectric:mc_works64mitsubishielectric mc works64le10.95.208.31
iconics:mobilehmiiconics mobilehmieq-
iconics:facility_analytixiconics facility analytixeq-
iconics:quality_analytixiconics quality analytixeq-
iconics:smart_energy_analytixiconics smart energy analytixeq-
iconics:energy_analytixiconics energy analytixeq-
iconics:genesis64iconics genesis64eq-
iconics:hyper_historianiconics hyper historianeq-
iconics:genesis32iconics genesis32eq-

CPE	Name	Operator	Version
mitsubishielectric:mc_works32	mitsubishielectric mc works32	eq	9.50.255.02
mitsubishielectric:mc_works64	mitsubishielectric mc works64	le	10.95.208.31
iconics:mobilehmi	iconics mobilehmi	eq	-
iconics:facility_analytix	iconics facility analytix	eq	-
iconics:quality_analytix	iconics quality analytix	eq	-
iconics:smart_energy_analytix	iconics smart energy analytix	eq	-
iconics:energy_analytix	iconics energy analytix	eq	-
iconics:genesis64	iconics genesis64	eq	-
iconics:hyper_historian	iconics hyper historian	eq	-
iconics:genesis32	iconics genesis32	eq	-

Rows per page:

1-10 of 111

References

us-cert.cisa.gov/ics/advisories/icsa-20-170-02

us-cert.cisa.gov/ics/advisories/icsa-20-170-03

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

9.5 High

AI Score

Confidence

High

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.004 Low

EPSS

Percentile

74.3%

JSON

Related for CVE-2020-12013

cvelist1 nessus1 prion1 zdi1 ics2