ICSA-21-021-05

icsaUScisa_csaf_ot

WAGO M&M Software fdtCONTAINER (Update C)

view advisory published 2021-01-21

If an attacker can socially engineer a valid user into loading a manipulated project file, malicious code can be executed without notice.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2020-12525UShigh7.8—
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
02

references

External citations — patches, advisories, analysis.

03

remediations (12)

  • MitigationEmerson Rosemount Transmitter Interface Software (RTIS) SKUs

    Do not open project data from an unknown source.

  • MitigationMitsubishi Electric MELSOFT FieldDeviceConfigurator

    Do not open project data from an unknown source.

  • MitigationPEPPERL+FUCHS PACTware

    Do not open project data from an unknown source.

  • MitigationWeidmüller WI Manager

    Do not open project data from an unknown source.

  • MitigationdtmINSPECTOR

    Do not open project data from an unknown source.

  • MitigationfdtCONTAINER

    Do not open project data from an unknown source.

  • FixedEmerson Rosemount Transmitter Interface Software (RTIS) SKUs

    Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.

  • FixedMitsubishi Electric MELSOFT FieldDeviceConfigurator

    Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.

  • FixedPEPPERL+FUCHS PACTware

    Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.

  • FixedWeidmüller WI Manager

    Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.

  • FixeddtmINSPECTOR

    Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.

  • FixedfdtCONTAINER

    Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan