CVE-2020-12013

Vulnerability

This vulnerability, identified as CVE-2020-12013, is a code injection flaw (CWE-94) in the GridWorX server component of Mitsubishi Electric MC Works64 (Version 4.02C (10.95.208.31) and earlier) and MC Works32 (Version 3.00A (9.50.255.02)), and in the FrameWorX Server of ICONICS GENESIS64 (v10.96 and prior) and GENESIS32 (v9.5 and prior). The issue arises from improper control of code generation when a specially crafted WCF client communicates with the affected server, potentially allowing the execution of arbitrary SQL commands [1][2].

Exploitation

To exploit this, an attacker needs network access to the affected server and the ability to send a specially crafted WCF message from a custom client. No authentication or user interaction is required. The attacker crafts a malicious WCF message that triggers the code injection, leading to arbitrary SQL command execution [1][2].

Impact

Successful exploitation could allow an attacker to execute arbitrary SQL commands on the server. This may result in information disclosure, tampering with data, and potentially further compromise of the SCADA system. The CVSS v3 base score for this vulnerability is 9.4 (Critical), with the vector string indicating high impact on confidentiality, integrity, and availability [1][2].

Mitigation

Mitsubishi Electric recommends upgrading MC Works64 to the latest version and MC Works32 to Version 3.00B (9.50.256.01) or later. ICONICS recommends upgrading GENESIS64 to v10.97 or later and GENESIS32 to v9.6 or later. No workarounds are provided in the advisories, and the CISA advisory recommends applying vendor patches as soon as possible [1][2].