← Back

CVE-2020-12013

nvd nist
Published: Jul 16, 2020Modified: Nov 21, 2024

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability: 3.9 / Impact: 5.2
Source: NVD

Description

A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.

Affected (11)

Mitsubishielectric
2 products
Mc Works32
Mc Works64
Iconics
9 products
Energy Analytix
Facility Analytix
Genesis64
Hyper Historian
Mobilehmi
Quality Analytix
Smart Energy Analytix
Bizviz
Genesis32
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Mc Works32
Version 9.50.255.02
Mc Works64
Up to 10.95.208.31
Configuration B
7 vulnerable
Vulnerable SoftwareAffected Versions
Energy Analytix
All versions
Facility Analytix
All versions
Genesis64
All versions
Hyper Historian
All versions
Mobilehmi
All versions
Quality Analytix
All versions
Smart Energy Analytix
All versions
Configuration C
2 vulnerable
Vulnerable SoftwareAffected Versions
Bizviz
All versions
Genesis32
All versions

Related CWEs

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (4)

Source: ics-cert@hq.dhs.gov
Third Party AdvisoryUS Government Resource
Source: ics-cert@hq.dhs.gov
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource

Timeline

No history available yet.