Описание
A Remote Code Execution vulnerability exists in PcVue from version 8.10 onward, due to the unsafe deserialization of messages received on the interface.
A Remote Code Execution vulnerability exists in PcVue from version 8.10 onward, due to the unsafe deserialization of messages received on the interface.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2020-26867
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://www.pcvuesolutions.com/index.php/support-a-services/resources/security-alerts-95138
- https://www.pcvuesolutions.com/security
- https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1
Связанные уязвимости
CVSS3: 9.8
nvd
больше 5 лет назад
ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
CVSS3: 9.8
fstec
больше 5 лет назад
Уязвимость SCADA-пакета PcVue, связанная с недостатками механизма десериализации, позволяющая нарушителю выполнить произвольный код