CVE-2020-12007

Vulnerability

This vulnerability is a deserialization of untrusted data (CWE-502) present in multiple products. Affected versions include Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, MC Works32 version 3.00A (9.50.255.02), ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior, and ICONICS GenBroker32 version 9.5 and prior [1]. The issue is triggered when a specially crafted communication packet is sent to the affected services.

Exploitation

An attacker can exploit this vulnerability remotely without authentication or user interaction [1]. The attacker sends a maliciously crafted packet to the target service (e.g., GenBroker64, Platform Services, Workbench, or FrameWorX Server). The packet contains serialized data that, when deserialized, leads to arbitrary code execution or a denial-of-service condition.

Impact

Successful exploitation allows an attacker to achieve remote code execution with the privileges of the affected service, or cause a denial-of-service condition [1]. This can lead to full compromise of the system, including data disclosure, modification, or disruption of operations.

Mitigation

ICONICS and Mitsubishi Electric have released updates to address this vulnerability. Users should upgrade to the latest versions as specified in the vendor advisories. For ICONICS products, version 10.97 or later is recommended [1]. For Mitsubishi Electric MC Works, contact the vendor for patched versions. If patching is not possible, restrict network access to the affected services and use firewalls to limit exposure.