Vulnerabilites related to iconics - mobilehmi
CVE-2020-12013 (GCVE-0-2020-12013)
Vulnerability from cvelistv5
Published
2020-07-16 21:14
Modified
2024-08-04 11:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-94 - IMPROPER CONTROL OF GENERATION OF CODE ('CODE INJECTION')
Summary
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Mitsubishi Electric | MC Works64 |
Version: Version 4.02C (10.95.208.31) and earlier Version: all versions |
||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:48:57.506Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MC Works64",
"vendor": "Mitsubishi Electric",
"versions": [
{
"status": "affected",
"version": "Version 4.02C (10.95.208.31) and earlier"
},
{
"status": "affected",
"version": "all versions"
}
]
},
{
"product": "MC Works32",
"vendor": "Mitsubishi Electric",
"versions": [
{
"status": "affected",
"version": "Version 3.00A (9.50.255.02)"
}
]
},
{
"product": "GenBroker64, Platform Services, Workbench, FrameWorX Server",
"vendor": "ICONICS",
"versions": [
{
"status": "affected",
"version": "v10.96 and prior"
}
]
},
{
"product": "GenBroker32",
"vendor": "ICONICS",
"versions": [
{
"status": "affected",
"version": "v9.5 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "IMPROPER CONTROL OF GENERATION OF CODE (\u0027CODE INJECTION\u0027) CWE-94",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-16T21:14:34",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-12013",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MC Works64",
"version": {
"version_data": [
{
"version_value": "Version 4.02C (10.95.208.31) and earlier"
},
{
"version_value": "all versions"
}
]
}
},
{
"product_name": "MC Works32",
"version": {
"version_data": [
{
"version_value": "Version 3.00A (9.50.255.02)"
}
]
}
}
]
},
"vendor_name": "Mitsubishi Electric"
},
{
"product": {
"product_data": [
{
"product_name": "GenBroker64, Platform Services, Workbench, FrameWorX Server",
"version": {
"version_data": [
{
"version_value": "v10.96 and prior"
}
]
}
},
{
"product_name": "GenBroker32",
"version": {
"version_data": [
{
"version_value": "v9.5 and prior"
}
]
}
}
]
},
"vendor_name": "ICONICS"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "IMPROPER CONTROL OF GENERATION OF CODE (\u0027CODE INJECTION\u0027) CWE-94"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-12013",
"datePublished": "2020-07-16T21:14:34",
"dateReserved": "2020-04-21T00:00:00",
"dateUpdated": "2024-08-04T11:48:57.506Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-23128 (GCVE-0-2022-23128)
Vulnerability from cvelistv5
Published
2022-01-21 18:17
Modified
2024-08-03 03:36
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Incomplete List of Disallowed Inputs
Summary
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Mitsubishi Electric MC Works64; ICONICS GENESIS64; ICONICS Hyper Historian; ICONICS AnalytiX; ICONICS MobileHMI |
Version: Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01) Version: ICONICS GENESIS64 versions 10.95.3 to 10.97 Version: ICONICS Hyper Historian versions 10.95.3 to 10.97 Version: ICONICS AnalytiX versions 10.95.3 to 10.97 Version: ICONICS MobileHMI versions 10.95.3 to 10.97 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:36:19.863Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Mitsubishi Electric MC Works64; ICONICS GENESIS64; ICONICS Hyper Historian; ICONICS AnalytiX; ICONICS MobileHMI",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01)"
},
{
"status": "affected",
"version": "ICONICS GENESIS64 versions 10.95.3 to 10.97"
},
{
"status": "affected",
"version": "ICONICS Hyper Historian versions 10.95.3 to 10.97"
},
{
"status": "affected",
"version": "ICONICS AnalytiX versions 10.95.3 to 10.97"
},
{
"status": "affected",
"version": "ICONICS MobileHMI versions 10.95.3 to 10.97"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Incomplete List of Disallowed Inputs",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-21T18:17:33",
"orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
"shortName": "Mitsubishi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"ID": "CVE-2022-23128",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Mitsubishi Electric MC Works64; ICONICS GENESIS64; ICONICS Hyper Historian; ICONICS AnalytiX; ICONICS MobileHMI",
"version": {
"version_data": [
{
"version_value": "Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01)"
},
{
"version_value": "ICONICS GENESIS64 versions 10.95.3 to 10.97"
},
{
"version_value": "ICONICS Hyper Historian versions 10.95.3 to 10.97"
},
{
"version_value": "ICONICS AnalytiX versions 10.95.3 to 10.97"
},
{
"version_value": "ICONICS MobileHMI versions 10.95.3 to 10.97"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Incomplete List of Disallowed Inputs"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jvn.jp/vu/JVNVU95403720/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
},
{
"name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf",
"refsource": "MISC",
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
"assignerShortName": "Mitsubishi",
"cveId": "CVE-2022-23128",
"datePublished": "2022-01-21T18:17:33",
"dateReserved": "2022-01-11T00:00:00",
"dateUpdated": "2024-08-03T03:36:19.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12009 (GCVE-0-2020-12009)
Vulnerability from cvelistv5
Published
2020-07-16 19:39
Modified
2024-09-16 23:00
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-502 - DESERIALIZATION OF UNTRUSTED DATA
Summary
A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Mitsubishi Electric | MC Works64 |
Version: 4.02C (10.95.208.31) and earlier Version: all versions |
||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:48:57.050Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MC Works64",
"vendor": "Mitsubishi Electric",
"versions": [
{
"status": "affected",
"version": "4.02C (10.95.208.31) and earlier"
},
{
"status": "affected",
"version": "all versions"
}
]
},
{
"product": "MC Works32",
"vendor": "Mitsubishi Electric",
"versions": [
{
"status": "affected",
"version": "Version 3.00A (9.50.255.02)"
}
]
},
{
"product": "GenBroker64, Platform Services, Workbench, FrameWorX Server",
"vendor": "ICONICS",
"versions": [
{
"status": "affected",
"version": "v10.96 and prior"
}
]
},
{
"product": "GenBroker32",
"vendor": "ICONICS",
"versions": [
{
"status": "affected",
"version": "v9.5 and prior"
}
]
}
],
"datePublic": "2020-06-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "DESERIALIZATION OF UNTRUSTED DATA CWE-502",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-16T19:39:24",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "2020-06-18T15:00:00.000Z",
"ID": "CVE-2020-12009",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MC Works64",
"version": {
"version_data": [
{
"version_value": "4.02C (10.95.208.31) and earlier"
},
{
"version_value": "all versions"
}
]
}
},
{
"product_name": "MC Works32",
"version": {
"version_data": [
{
"version_value": "Version 3.00A (9.50.255.02)"
}
]
}
}
]
},
"vendor_name": "Mitsubishi Electric"
},
{
"product": {
"product_data": [
{
"product_name": "GenBroker64, Platform Services, Workbench, FrameWorX Server",
"version": {
"version_data": [
{
"version_value": "v10.96 and prior"
}
]
}
},
{
"product_name": "GenBroker32",
"version": {
"version_data": [
{
"version_value": "v9.5 and prior"
}
]
}
}
]
},
"vendor_name": "ICONICS"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "DESERIALIZATION OF UNTRUSTED DATA CWE-502"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-12009",
"datePublished": "2020-07-16T19:39:24.072953Z",
"dateReserved": "2020-04-21T00:00:00",
"dateUpdated": "2024-09-16T23:00:29.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-23127 (GCVE-0-2022-23127)
Vulnerability from cvelistv5
Published
2022-01-21 18:17
Modified
2024-08-03 03:36
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Cross-site Scripting
Summary
Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL.
References
| ► | URL | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| n/a | Mitsubishi Electric MC Works64; ICONICS MobileHMI |
Version: Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior Version: ICONICS MobileHMI versions 10.96.2 and prior |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T03:36:20.098Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdf"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Mitsubishi Electric MC Works64; ICONICS MobileHMI",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior"
},
{
"status": "affected",
"version": "ICONICS MobileHMI versions 10.96.2 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-01-21T18:17:32",
"orgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
"shortName": "Mitsubishi"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdf"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"ID": "CVE-2022-23127",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Mitsubishi Electric MC Works64; ICONICS MobileHMI",
"version": {
"version_data": [
{
"version_value": "Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior"
},
{
"version_value": "ICONICS MobileHMI versions 10.96.2 and prior"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://jvn.jp/vu/JVNVU95403720/index.html",
"refsource": "MISC",
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"name": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdf",
"refsource": "MISC",
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdf"
},
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "e0f77b61-78fd-4786-b3fb-1ee347a748ad",
"assignerShortName": "Mitsubishi",
"cveId": "CVE-2022-23127",
"datePublished": "2022-01-21T18:17:32",
"dateReserved": "2022-01-11T00:00:00",
"dateUpdated": "2024-08-03T03:36:20.098Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12007 (GCVE-0-2020-12007)
Vulnerability from cvelistv5
Published
2020-07-16 21:49
Modified
2024-08-04 11:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-502 - DESERIALIZATION OF UNTRUSTED DATA
Summary
A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Mitsubishi Electric | MC Works64 |
Version: Version 4.02C (10.95.208.31) and earlier Version: all versions |
||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:48:57.519Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MC Works64",
"vendor": "Mitsubishi Electric",
"versions": [
{
"status": "affected",
"version": "Version 4.02C (10.95.208.31) and earlier"
},
{
"status": "affected",
"version": "all versions"
}
]
},
{
"product": "MC Works32",
"vendor": "Mitsubishi Electric",
"versions": [
{
"status": "affected",
"version": "Version 3.00A (9.50.255.02)"
}
]
},
{
"product": "GenBroker64, Platform Services, Workbench, FrameWorX Server",
"vendor": "ICONICS",
"versions": [
{
"status": "affected",
"version": "v10.96 and prior"
}
]
},
{
"product": "GenBroker32",
"vendor": "ICONICS",
"versions": [
{
"status": "affected",
"version": "v9.5 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "DESERIALIZATION OF UNTRUSTED DATA CWE-502",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-16T21:49:12",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-12007",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MC Works64",
"version": {
"version_data": [
{
"version_value": "Version 4.02C (10.95.208.31) and earlier"
},
{
"version_value": "all versions"
}
]
}
},
{
"product_name": "MC Works32",
"version": {
"version_data": [
{
"version_value": "Version 3.00A (9.50.255.02)"
}
]
}
}
]
},
"vendor_name": "Mitsubishi Electric"
},
{
"product": {
"product_data": [
{
"product_name": "GenBroker64, Platform Services, Workbench, FrameWorX Server",
"version": {
"version_data": [
{
"version_value": "v10.96 and prior"
}
]
}
},
{
"product_name": "GenBroker32",
"version": {
"version_data": [
{
"version_value": "v9.5 and prior"
}
]
}
}
]
},
"vendor_name": "ICONICS"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "DESERIALIZATION OF UNTRUSTED DATA CWE-502"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02,",
"refsource": "CONFIRM",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02,"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-12007",
"datePublished": "2020-07-16T21:49:12",
"dateReserved": "2020-04-21T00:00:00",
"dateUpdated": "2024-08-04T11:48:57.519Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12015 (GCVE-0-2020-12015)
Vulnerability from cvelistv5
Published
2020-07-16 21:30
Modified
2024-08-04 11:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-502 - DESERIALIZATION OF UNTRUSTED DATA
Summary
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Mitsubishi Electric | MC Works64 |
Version: version 4.02C (10.95.208.31) and earlier Version: all versions |
||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:48:57.726Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-03"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-02"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "MC Works64",
"vendor": "Mitsubishi Electric",
"versions": [
{
"status": "affected",
"version": "version 4.02C (10.95.208.31) and earlier"
},
{
"status": "affected",
"version": "all versions"
}
]
},
{
"product": "MC Works32",
"vendor": "Mitsubishi Electric",
"versions": [
{
"status": "affected",
"version": "version 3.00A (9.50.255.02)"
}
]
},
{
"product": "GenBroker64, Platform Services, Workbench, FrameWorX Server",
"vendor": "ICONICS",
"versions": [
{
"status": "affected",
"version": "version 10.96 and prior"
}
]
},
{
"product": "GenBroker32",
"vendor": "ICONICS",
"versions": [
{
"status": "affected",
"version": "version 9.5 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-502",
"description": "DESERIALIZATION OF UNTRUSTED DATA CWE-502",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-16T21:30:43",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-03"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-02"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-12015",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "MC Works64",
"version": {
"version_data": [
{
"version_value": "version 4.02C (10.95.208.31) and earlier"
},
{
"version_value": "all versions"
}
]
}
},
{
"product_name": "MC Works32",
"version": {
"version_data": [
{
"version_value": "version 3.00A (9.50.255.02)"
}
]
}
}
]
},
"vendor_name": "Mitsubishi Electric"
},
{
"product": {
"product_data": [
{
"product_name": "GenBroker64, Platform Services, Workbench, FrameWorX Server",
"version": {
"version_data": [
{
"version_value": "version 10.96 and prior"
}
]
}
},
{
"product_name": "GenBroker32",
"version": {
"version_data": [
{
"version_value": "version 9.5 and prior"
}
]
}
}
]
},
"vendor_name": "ICONICS"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "DESERIALIZATION OF UNTRUSTED DATA CWE-502"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-20-170-03",
"refsource": "CONFIRM",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-03"
},
{
"name": "https://www.us-cert.gov/ics/advisories/icsa-20-170-02",
"refsource": "CONFIRM",
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-02"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-12015",
"datePublished": "2020-07-16T21:30:43",
"dateReserved": "2020-04-21T00:00:00",
"dateUpdated": "2024-08-04T11:48:57.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-12011 (GCVE-0-2020-12011)
Vulnerability from cvelistv5
Published
2020-07-16 18:53
Modified
2024-08-04 11:48
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-787 - OUT-OF-BOUNDS WRITE
Summary
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior.
References
| ► | URL | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | n/a | Mitsubishi Electric MC Works64 |
Version: Version 4.02C (10.95.208.31) and earlier Version: all versions |
||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:48:57.125Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Mitsubishi Electric MC Works64",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Version 4.02C (10.95.208.31) and earlier"
},
{
"status": "affected",
"version": "all versions"
}
]
},
{
"product": "MC Works32",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Version 3.00A (9.50.255.02)"
}
]
},
{
"product": "ICONICS\u00a0 GenBroker64, Platform Services, Workbench, FrameWorX Server",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "v10.96 and prior"
}
]
},
{
"product": "GenBroker32",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "v9.5 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "OUT-OF-BOUNDS WRITE CWE-787",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-07-16T18:53:05",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "ics-cert@hq.dhs.gov",
"ID": "CVE-2020-12011",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Mitsubishi Electric MC Works64",
"version": {
"version_data": [
{
"version_value": "Version 4.02C (10.95.208.31) and earlier"
},
{
"version_value": "all versions"
}
]
}
},
{
"product_name": "MC Works32",
"version": {
"version_data": [
{
"version_value": "Version 3.00A (9.50.255.02)"
}
]
}
},
{
"product_name": "ICONICS\u00a0 GenBroker64, Platform Services, Workbench, FrameWorX Server",
"version": {
"version_data": [
{
"version_value": "v10.96 and prior"
}
]
}
},
{
"product_name": "GenBroker32",
"version": {
"version_data": [
{
"version_value": "v9.5 and prior"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "OUT-OF-BOUNDS WRITE CWE-787"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"name": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03",
"refsource": "MISC",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2020-12011",
"datePublished": "2020-07-16T18:53:05",
"dateReserved": "2020-04-21T00:00:00",
"dateUpdated": "2024-08-04T11:48:57.125Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2022-01-21 19:15
Modified
2024-11-21 06:48
Severity ?
Summary
Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp | https://jvn.jp/vu/JVNVU95403720/index.html | Mitigation, Third Party Advisory, VDB Entry | |
| Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp | https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01 | Mitigation, Third Party Advisory, US Government Resource, VDB Entry | |
| Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp | https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf | Mitigation, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jvn.jp/vu/JVNVU95403720/index.html | Mitigation, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01 | Mitigation, Third Party Advisory, US Government Resource, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf | Mitigation, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| iconics | analytix | * | |
| iconics | genesis64 | * | |
| iconics | hyper_historian | * | |
| iconics | mobilehmi | * | |
| mitsubishielectric | mc_works64 | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:analytix:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9D4A6919-8FA2-4D81-991F-1960EA3F0DE1",
"versionEndIncluding": "10.97",
"versionStartIncluding": "10.95.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis64:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1B337BB0-925C-4B18-B4FD-CF786F47642F",
"versionEndIncluding": "10.97",
"versionStartIncluding": "10.95.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:hyper_historian:*:*:*:*:*:*:*:*",
"matchCriteriaId": "170EE68A-2E3C-441B-98E3-7CFD238E80D1",
"versionEndIncluding": "10.97",
"versionStartIncluding": "10.95.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:mobilehmi:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7C0D55FF-E640-48D1-8B0D-2FB036E897EB",
"versionEndIncluding": "10.97",
"versionStartIncluding": "10.95.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AD31D401-1AD5-4D75-83B8-648AA794E557",
"versionEndIncluding": "10.95.210.01",
"versionStartIncluding": "10.95.201.23",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GENESIS64 versions 10.95.3 to 10.97, ICONICS Hyper Historian versions 10.95.3 to 10.97, ICONICS AnalytiX versions 10.95.3 to 10.97 and ICONICS MobileHMI versions 10.95.3 to 10.97 allows a remote unauthenticated attacker to bypass the authentication of MC Works64, GENESIS64, Hyper Historian, AnalytiX and MobileHMI, and gain unauthorized access to the products, by sending specially crafted WebSocket packets to FrameWorX server, one of the functions of the products."
},
{
"lang": "es",
"value": "Una vulnerabilidad \"Incomplete List of Disallowed Inputs\" en Mitsubishi Electric MC Works64 versiones 4.00A (10.95.201.23) a 4.04E (10.95.210.01), ICONICS GENESIS64 versiones 10.95.3 a 10.97, ICONICS Hyper Historian versiones 10.95.3 a 10.97, ICONICS AnalytiX versiones 10.95.3 a 10.97 e ICONICS MobileHMI versiones 10. 95.3 a 10.97 permite a un atacante remoto no autenticado omitir la autenticaci\u00f3n de MC Works64, GENESIS64, Hyper Historian, AnalytiX y MobileHMI, y conseguir acceso no autorizado a los productos, mediante el env\u00edo de paquetes WebSocket especialmente dise\u00f1ados al servidor FrameWorX, una de las funciones de los productos"
}
],
"id": "CVE-2022-23128",
"lastModified": "2024-11-21T06:48:03.407",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-01-21T19:15:09.977",
"references": [
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"tags": [
"Mitigation",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"tags": [
"Mitigation",
"Third Party Advisory",
"US Government Resource",
"VDB Entry"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
},
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Third Party Advisory",
"US Government Resource",
"VDB Entry"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-026_en.pdf"
}
],
"sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-07-16 22:15
Modified
2024-11-21 04:59
Severity ?
Summary
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://www.us-cert.gov/ics/advisories/icsa-20-170-02 | Third Party Advisory, US Government Resource | |
| ics-cert@hq.dhs.gov | https://www.us-cert.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.us-cert.gov/ics/advisories/icsa-20-170-02 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.us-cert.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mitsubishielectric | mc_works | * | |
| mitsubishielectric | mc_works32 | 9.50.255.02 | |
| iconics | energy_analytix | - | |
| iconics | facility_analytix | - | |
| iconics | genesis64 | - | |
| iconics | hyper_historian | - | |
| iconics | mobilehmi | - | |
| iconics | quality_analytix | - | |
| iconics | smart_energy_analytix | - | |
| iconics | bizviz | - | |
| iconics | genesis32 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C9B1F646-0D54-4B3A-B39A-A45E1A0615EB",
"versionEndIncluding": "10.95.208.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works32:9.50.255.02:*:*:*:*:*:*:*",
"matchCriteriaId": "A68D91E4-0C65-45F0-965E-A6AAE0E2F09F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD143148-B191-4D8E-9C28-09D4AC5D192C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:facility_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3C5226-94D4-4826-9B76-72626081DF46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis64:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17E644D8-AB8E-4E3C-AE4B-64D3BBCC30BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:hyper_historian:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78FF2A71-4918-491E-A5D8-DEB9E17FA6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:mobilehmi:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16745C56-A59A-4C38-92E1-FC5C63220989",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:quality_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "717A4B7B-2A42-4A9C-961F-1EA5E62FB188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:smart_energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5082C435-FCCD-4CF6-891E-73F846A6FB40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:bizviz:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF628CB2-BCA9-4E69-A9CB-846577F98DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis32:-:*:*:*:*:*:*:*",
"matchCriteriaId": "771DB32A-CD85-4638-B90E-25D9B4951DE5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior."
},
{
"lang": "es",
"value": "Un paquete de comunicaci\u00f3n especialmente dise\u00f1ado enviado a los sistemas afectados podr\u00eda causar una condici\u00f3n de denegaci\u00f3n de servicio debido a una deserializaci\u00f3n inapropiada. Este problema afecta: Mitsubishi Electric MC Works64 versi\u00f3n 4.02C (10.95.208.31) y anteriores, todas las versiones; Mitsubishi Electric MC Works32 versi\u00f3n 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versi\u00f3n v10.96 y anteriores; ICONICS GenBroker32 versi\u00f3n 9.5 y anteriores"
}
],
"id": "CVE-2020-12015",
"lastModified": "2024-11-21T04:59:07.153",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-16T22:15:11.493",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-02"
},
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.us-cert.gov/ics/advisories/icsa-20-170-03"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-07-16 22:15
Modified
2024-11-21 04:59
Severity ?
Summary
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 | Third Party Advisory, US Government Resource | |
| ics-cert@hq.dhs.gov | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mitsubishielectric | mc_works32 | 9.50.255.02 | |
| mitsubishielectric | mc_works64 | * | |
| iconics | energy_analytix | - | |
| iconics | facility_analytix | - | |
| iconics | genesis64 | - | |
| iconics | hyper_historian | - | |
| iconics | mobilehmi | - | |
| iconics | quality_analytix | - | |
| iconics | smart_energy_analytix | - | |
| iconics | bizviz | - | |
| iconics | genesis32 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works32:9.50.255.02:*:*:*:*:*:*:*",
"matchCriteriaId": "A68D91E4-0C65-45F0-965E-A6AAE0E2F09F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9DFE4C50-FB00-4449-8A7F-D524109A1F1D",
"versionEndIncluding": "10.95.208.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD143148-B191-4D8E-9C28-09D4AC5D192C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:facility_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3C5226-94D4-4826-9B76-72626081DF46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis64:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17E644D8-AB8E-4E3C-AE4B-64D3BBCC30BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:hyper_historian:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78FF2A71-4918-491E-A5D8-DEB9E17FA6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:mobilehmi:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16745C56-A59A-4C38-92E1-FC5C63220989",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:quality_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "717A4B7B-2A42-4A9C-961F-1EA5E62FB188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:smart_energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5082C435-FCCD-4CF6-891E-73F846A6FB40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:bizviz:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF628CB2-BCA9-4E69-A9CB-846577F98DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis32:-:*:*:*:*:*:*:*",
"matchCriteriaId": "771DB32A-CD85-4638-B90E-25D9B4951DE5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior."
},
{
"lang": "es",
"value": "Un cliente WCF especialmente dise\u00f1ado que interact\u00faa con el puede permitir la ejecuci\u00f3n de determinados comandos SQL arbitrarios remotamente. Esto afecta: Mitsubishi Electric MC Works64 Versi\u00f3n 4.02C (10.95.208.31) y anteriores, todas las versiones; Mitsubishi Electric MC Works32 versi\u00f3n 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versi\u00f3n v10.96 y anteriores; ICONICS GenBroker32 versi\u00f3n v9.5 y anteriores"
}
],
"id": "CVE-2020-12013",
"lastModified": "2024-11-21T04:59:06.937",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-16T22:15:11.417",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-01-21 19:15
Modified
2024-11-21 06:48
Severity ?
Summary
Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp | https://jvn.jp/vu/JVNVU95403720/index.html | Mitigation, Third Party Advisory, VDB Entry | |
| Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp | https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01 | Mitigation, Third Party Advisory, US Government Resource, VDB Entry | |
| Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp | https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdf | Mitigation, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://jvn.jp/vu/JVNVU95403720/index.html | Mitigation, Third Party Advisory, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01 | Mitigation, Third Party Advisory, US Government Resource, VDB Entry | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdf | Mitigation, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| iconics | mobilehmi | * | |
| mitsubishielectric | mc_works64 | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:mobilehmi:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE5EB5D9-0582-4C46-8D3C-34B8AE1E24BB",
"versionEndIncluding": "10.96.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works64:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D31E1BFD-8194-4BA1-998B-BC4005454C15",
"versionEndExcluding": "10.95.210.01",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the acquired authentication information, by injecting a malicious script in the URL of a monitoring screen delivered from the MC Works64 server or MobileHMI server to an application for mobile devices and leading a legitimate user to access this URL."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo Cross-site Scripting en Mitsubishi Electric MC Works64 versiones 4.04E (10.95.210.01) y anteriores, y en ICONICS MobileHMI versiones 10.96.2 y anteriores, permite a un atacante remoto no autenticado conseguir informaci\u00f3n de autenticaci\u00f3n de un MC Works64 o MobileHMI y llevar a cabo cualquier operaci\u00f3n usando la informaci\u00f3n de autenticaci\u00f3n adquirida, inyectando un script malicioso en la URL de una pantalla de monitorizaci\u00f3n entregada desde el servidor MC Works64 o el servidor MobileHMI a una aplicaci\u00f3n para dispositivos m\u00f3viles y llevando a un usuario leg\u00edtimo a acceder a esta URL"
}
],
"id": "CVE-2022-23127",
"lastModified": "2024-11-21T06:48:03.273",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-01-21T19:15:09.913",
"references": [
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"tags": [
"Mitigation",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"tags": [
"Mitigation",
"Third Party Advisory",
"US Government Resource",
"VDB Entry"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
},
{
"source": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdf"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://jvn.jp/vu/JVNVU95403720/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Third Party Advisory",
"US Government Resource",
"VDB Entry"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-020-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mitigation",
"Vendor Advisory"
],
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2021-025_en.pdf"
}
],
"sourceIdentifier": "Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-07-16 19:15
Modified
2024-11-21 04:59
Severity ?
Summary
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 | Third Party Advisory, US Government Resource | |
| ics-cert@hq.dhs.gov | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mitsubishielectric | mc_works | * | |
| mitsubishielectric | mc_works32 | 9.50.255.02 | |
| iconics | energy_analytix | - | |
| iconics | facility_analytix | - | |
| iconics | genesis64 | - | |
| iconics | hyper_historian | - | |
| iconics | mobilehmi | - | |
| iconics | quality_analytix | - | |
| iconics | smart_energy_analytix | - | |
| iconics | bizviz | - | |
| iconics | genesis32 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C9B1F646-0D54-4B3A-B39A-A45E1A0615EB",
"versionEndIncluding": "10.95.208.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works32:9.50.255.02:*:*:*:*:*:*:*",
"matchCriteriaId": "A68D91E4-0C65-45F0-965E-A6AAE0E2F09F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD143148-B191-4D8E-9C28-09D4AC5D192C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:facility_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3C5226-94D4-4826-9B76-72626081DF46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis64:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17E644D8-AB8E-4E3C-AE4B-64D3BBCC30BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:hyper_historian:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78FF2A71-4918-491E-A5D8-DEB9E17FA6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:mobilehmi:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16745C56-A59A-4C38-92E1-FC5C63220989",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:quality_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "717A4B7B-2A42-4A9C-961F-1EA5E62FB188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:smart_energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5082C435-FCCD-4CF6-891E-73F846A6FB40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:bizviz:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF628CB2-BCA9-4E69-A9CB-846577F98DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis32:-:*:*:*:*:*:*:*",
"matchCriteriaId": "771DB32A-CD85-4638-B90E-25D9B4951DE5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior."
},
{
"lang": "es",
"value": "Un paquete de comunicaci\u00f3n especialmente dise\u00f1ado enviado a los sistemas afectados podr\u00eda causar una condici\u00f3n de denegaci\u00f3n de servicio o permitir una ejecuci\u00f3n de c\u00f3digo remota. Este problema afecta: Mitsubishi Electric MC Works64 versi\u00f3n 4.02C (10.95.208.31) y anteriores, todas las versiones; MC Works32 versi\u00f3n 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versi\u00f3n 10.96 y anteriores; GenBroker32 versi\u00f3n 9.5 y anteriores"
}
],
"id": "CVE-2020-12011",
"lastModified": "2024-11-21T04:59:06.677",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-16T19:15:11.830",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-07-16 20:15
Modified
2024-11-21 04:59
Severity ?
Summary
A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 | Third Party Advisory, US Government Resource | |
| ics-cert@hq.dhs.gov | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mitsubishielectric | mc_works | * | |
| mitsubishielectric | mc_works32 | 9.50.255.02 | |
| iconics | energy_analytix | - | |
| iconics | facility_analytix | - | |
| iconics | genesis64 | - | |
| iconics | hyper_historian | - | |
| iconics | mobilehmi | - | |
| iconics | quality_analytix | - | |
| iconics | smart_energy_analytix | - | |
| iconics | bizviz | - | |
| iconics | genesis32 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C9B1F646-0D54-4B3A-B39A-A45E1A0615EB",
"versionEndIncluding": "10.95.208.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works32:9.50.255.02:*:*:*:*:*:*:*",
"matchCriteriaId": "A68D91E4-0C65-45F0-965E-A6AAE0E2F09F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD143148-B191-4D8E-9C28-09D4AC5D192C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:facility_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3C5226-94D4-4826-9B76-72626081DF46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis64:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17E644D8-AB8E-4E3C-AE4B-64D3BBCC30BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:hyper_historian:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78FF2A71-4918-491E-A5D8-DEB9E17FA6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:mobilehmi:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16745C56-A59A-4C38-92E1-FC5C63220989",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:quality_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "717A4B7B-2A42-4A9C-961F-1EA5E62FB188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:smart_energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5082C435-FCCD-4CF6-891E-73F846A6FB40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:bizviz:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF628CB2-BCA9-4E69-A9CB-846577F98DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis32:-:*:*:*:*:*:*:*",
"matchCriteriaId": "771DB32A-CD85-4638-B90E-25D9B4951DE5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior."
},
{
"lang": "es",
"value": "Un paquete de comunicaci\u00f3n especialmente dise\u00f1ado enviado al dispositivo afectado podr\u00eda causar una condici\u00f3n de denegaci\u00f3n de servicio debido a una vulnerabilidad de deserializaci\u00f3n. Esto afecta: Mitsubishi Electric MC Works64 versi\u00f3n 4.02C (10.95.208.31) y anteriores, todas las versiones; Mitsubishi Electric MC Works32 versi\u00f3n 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versi\u00f3n v10.96 y anteriores; ICONICS GenBroker32 versi\u00f3n v9.5 y anteriores"
}
],
"id": "CVE-2020-12009",
"lastModified": "2024-11-21T04:59:06.433",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-16T20:15:11.057",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-07-16 22:15
Modified
2024-11-21 04:59
Severity ?
Summary
A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C | ||
| ics-cert@hq.dhs.gov | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| mitsubishielectric | mc_works | * | |
| mitsubishielectric | mc_works32 | 9.50.255.02 | |
| iconics | energy_analytix | - | |
| iconics | facility_analytix | - | |
| iconics | genesis64 | - | |
| iconics | hyper_historian | - | |
| iconics | mobilehmi | - | |
| iconics | quality_analytix | - | |
| iconics | smart_energy_analytix | - | |
| iconics | bizviz | - | |
| iconics | genesis32 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C9B1F646-0D54-4B3A-B39A-A45E1A0615EB",
"versionEndIncluding": "10.95.208.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:mitsubishielectric:mc_works32:9.50.255.02:*:*:*:*:*:*:*",
"matchCriteriaId": "A68D91E4-0C65-45F0-965E-A6AAE0E2F09F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "DD143148-B191-4D8E-9C28-09D4AC5D192C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:facility_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BE3C5226-94D4-4826-9B76-72626081DF46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis64:-:*:*:*:*:*:*:*",
"matchCriteriaId": "17E644D8-AB8E-4E3C-AE4B-64D3BBCC30BF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:hyper_historian:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78FF2A71-4918-491E-A5D8-DEB9E17FA6E4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:mobilehmi:-:*:*:*:*:*:*:*",
"matchCriteriaId": "16745C56-A59A-4C38-92E1-FC5C63220989",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:quality_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "717A4B7B-2A42-4A9C-961F-1EA5E62FB188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:smart_energy_analytix:-:*:*:*:*:*:*:*",
"matchCriteriaId": "5082C435-FCCD-4CF6-891E-73F846A6FB40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:iconics:bizviz:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CF628CB2-BCA9-4E69-A9CB-846577F98DA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:iconics:genesis32:-:*:*:*:*:*:*:*",
"matchCriteriaId": "771DB32A-CD85-4638-B90E-25D9B4951DE5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior."
},
{
"lang": "es",
"value": "Un paquete de comunicaci\u00f3n especialmente dise\u00f1ado enviado a los dispositivos afectados podr\u00eda permitir una ejecuci\u00f3n de c\u00f3digo remota y una condici\u00f3n de denegaci\u00f3n de servicio debido a una vulnerabilidad de deserializaci\u00f3n. Este problema afecta: Mitsubishi Electric MC Works64 versi\u00f3n 4.02C (10.95.208.31) y anteriores, todas las versiones; Mitsubishi Electric MC Works32 versi\u00f3n 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server versi\u00f3n 10.96 y anteriores; ICONICS GenBroker32 versi\u00f3n 9.5 y anteriores"
}
],
"id": "CVE-2020-12007",
"lastModified": "2024-11-21T04:59:06.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-07-16T22:15:11.337",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C"
},
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-502"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}