CVE-2020-26867

Опубликовано: 12 окт. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.

Ссылки

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/
Broken Link
https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
Third Party Advisory
US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
Third Party Advisory
US Government Resource
https://www.pcvuesolutions.com/security
Vendor Advisory
https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1
Permissions Required
Vendor Advisory
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/
Broken Link
https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
Third Party Advisory
US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
Third Party Advisory
US Government Resource
https://www.pcvuesolutions.com/security
Vendor Advisory
https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1
Permissions Required
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:pcvuesolutions:pcvue:*:*:*:*:*:*:*:*

Версия от 8.10 (включая) до 12.0.17 (исключая)

EPSS

Процентиль: 87%

0.03235

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-7x49-vpw9-2vmr

CVSS3: 9.8

github

больше 3 лет назад

A Remote Code Execution vulnerability exists in PcVue from version 8.10 onward, due to the unsafe deserialization of messages received on the interface.

BDU:2020-04796

CVSS3: 9.8

fstec

больше 5 лет назад

Уязвимость SCADA-пакета PcVue, связанная с недостатками механизма десериализации, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 87%

0.03235

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-502