CVE-2020-12015 Deserialization in GenBroker32
Attackers can cause denial of service in Mitsubishi and ICONICS SCADA systems by sending crafted packets exploiting improper deserialization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-12015?
CVE-2020-12015 is a high-severity unsafe deserialization vulnerability in ICONICS GenBroker32, published on 16 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.
Weakness: CWE-502
Which versions are affected by CVE-2020-12015?
It affects 11 products.
Products include Iconics Bizviz, Iconics Energy Analytix, Iconics Facility Analytix, Iconics Genesis32, Iconics Genesis64, Iconics Hyper Historian and 5 more.
How do I fix CVE-2020-12015?
No fix has been published for CVE-2020-12015 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-12015 being exploited?
There is no known exploitation of CVE-2020-12015 in the wild and no public exploit code.
Other vulnerabilities in ICONICS GenBroker32
Sources
Also known as GHSA-jfw2-jwr5-36c3.