WAGO M&M Software fdtCONTAINER (Update C)
If an attacker can socially engineer a valid user into loading a manipulated project file, malicious code can be executed without notice.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-12525US | high7.8 | — | ||
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (12)
- MitigationEmerson Rosemount Transmitter Interface Software (RTIS) SKUs
Do not open project data from an unknown source.
- MitigationMitsubishi Electric MELSOFT FieldDeviceConfigurator
Do not open project data from an unknown source.
- MitigationPEPPERL+FUCHS PACTware
Do not open project data from an unknown source.
- MitigationWeidmüller WI Manager
Do not open project data from an unknown source.
- MitigationdtmINSPECTOR
Do not open project data from an unknown source.
- MitigationfdtCONTAINER
Do not open project data from an unknown source.
- BehobenEmerson Rosemount Transmitter Interface Software (RTIS) SKUs
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- BehobenMitsubishi Electric MELSOFT FieldDeviceConfigurator
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- BehobenPEPPERL+FUCHS PACTware
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- BehobenWeidmüller WI Manager
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- BehobendtmINSPECTOR
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- BehobenfdtCONTAINER
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan