Pepperl+Fuchs: Vulnerability allowing code-excution in PACTware <=5.0.5.31
A critical vulnerability has been discovered in the fdtCONTAINER component by M&M Software GmbH used by PACTware. While de-serializing PACTware 5 project files (loading PW5 files) the vulnerability can be exploited to execute arbitrary code.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-12525US | high7.8 | — | ||
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage. | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- MitigationPACTware
Exchange project data only via secure exchange services Use appropriate means to protect the project storage from unauthorized manipulation Do not open project data from an unknown source Reduce the user rights of the host application to the necessary minimum
- FixedPACTware
A fix for the issue will be provided with PACTware 6 in Q2 2021 which includes the proposed solution by M&M based on FDT Container component version >= 3.6.20304.x.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan