Pepperl+Fuchs: Vulnerability allowing code-excution in PACTware <=5.0.5.31
A critical vulnerability has been discovered in the fdtCONTAINER component by M&M Software GmbH used by PACTware. While de-serializing PACTware 5 project files (loading PW5 files) the vulnerability can be exploited to execute arbitrary code.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-12525US | high7.8 | — | ||
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- MitigationPACTware
Exchange project data only via secure exchange services Use appropriate means to protect the project storage from unauthorized manipulation Do not open project data from an unknown source Reduce the user rights of the host application to the necessary minimum
- BehobenPACTware
A fix for the issue will be provided with PACTware 6 in Q2 2021 which includes the proposed solution by M&M based on FDT Container component version >= 3.6.20304.x.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan