CVE-2020-12525
mediumpriority · track · 31EPSS 0.014 · 72 %ileDEEUUSEPSS · scored 2026-10-27
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedwago_psirt
M&M provides two technical solution options. Customers may choose between the following: --- ### Option 1: Update the `fdtCONTAINER component` or `fdtCONTAINER application` to a version that offers **more secure deserialization** of project data. - This version still uses a **deprecated serialization technology**, but fixes the currently known attack vector. - It remains **compatible with existing, non-manipulated project files**. **Implemented in:** - `fdtCONTAINER component`: **3.6.20304.x – < 3.7** - `fdtCONTAINER application`: **4.6.20304.x – < 4.7** --- ### Option 2: Update the `fdtCONTAINER component` or `fdtCONTAINER application` to a version that uses an **updated serialization technology** for deserialization. - This option ensures **secure handling of project data**. - **Incompatible** with existing, non-manipulated project files. **Implemented in:** - `fdtCONTAINER component`: **≥ 3.7** - `fdtCONTAINER application`: **≥ 4.7** --- The fixed version of `dtmINSPECTOR` will also apply **Option 2** and is planned to be available in **Q1 2021**.
- FixedPACTwarepepperl_fuchs_psirt
A fix for the issue will be provided with PACTware 6 in Q2 2021 which includes the proposed solution by M&M based on FDT Container component version >= 3.6.20304.x.
- Fixedendress_hauser_psirt
Planned for future versions
- FixedEmerson Rosemount Transmitter Interface Software (RTIS) SKUscisa_csaf_ot
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- FixedMitsubishi Electric MELSOFT FieldDeviceConfiguratorcisa_csaf_ot
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- FixedPEPPERL+FUCHS PACTwarecisa_csaf_ot
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- FixedWeidmüller WI Managercisa_csaf_ot
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- FixeddtmINSPECTORcisa_csaf_ot
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- FixedfdtCONTAINERcisa_csaf_ot
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
- Mitigationwago_psirt
- Exchange project data only via secure exchange services - Use appropriate means to protect the project storage from unauthorized manipulation - Do not open project data from an unknown source - Reduce the user rights of the host application to the necessary minimum
- MitigationPACTwarepepperl_fuchs_psirt
Exchange project data only via secure exchange services Use appropriate means to protect the project storage from unauthorized manipulation Do not open project data from an unknown source Reduce the user rights of the host application to the necessary minimum
- MitigationWI Managerweidmueller_psirt
- Exchange project data only via secure exchange services - Use appropriate means to protect the project storage from unauthorized manipulation - Do not open project data from an unknown source - Reduce the user rights of the WI Manager to the necessary minimum
- Mitigationendress_hauser_psirt
1. Exchange project data only via secure exchange services 2. Use appropriate means to protect the project storage from unauthorized manipulation 3. Do not open project data from an unknown source 4. Reduce the user rights of the host application to the necessary minimum
- MitigationEmerson Rosemount Transmitter Interface Software (RTIS) SKUscisa_csaf_ot
Do not open project data from an unknown source.
- MitigationMitsubishi Electric MELSOFT FieldDeviceConfiguratorcisa_csaf_ot
Do not open project data from an unknown source.
- MitigationPEPPERL+FUCHS PACTwarecisa_csaf_ot
Do not open project data from an unknown source.
- MitigationWeidmüller WI Managercisa_csaf_ot
Do not open project data from an unknown source.
- MitigationdtmINSPECTORcisa_csaf_ot
Do not open project data from an unknown source.
- MitigationfdtCONTAINERcisa_csaf_ot
Do not open project data from an unknown source.
- MitigationEcoStruxure Control Expertcisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01 - MitigationEcoStruxure Process Expertcisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01 - MitigationModicon M340 CPU (part numbers BMXP34*)cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01 - MitigationModicon M580 CPU (part numbers BMEP* and BMEH*)cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01 - MitigationSCADAPack RemoteConnect for x70cisa_csaf_ot
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.8
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (86)
Products and version ranges known to be affected.
advisories (6)
Vendor and ecosystem advisories describing this.
- VDE-2020-048M&M Software (WAGO): Deserialisation of untrusted data in fdtContainer2021-01-14csaf · wago_psirtDE
The fdtCONTAINER component is integrated into an application (host application). The fdtCONTAINER application is a specific host application which integrates the fdtCONTAINER component. The fdtCONTAINER component exchanges binary data blobs with such a host application. Typically, the host application saves these binary data blobs into a project storage (project file or a project database). To manipulate the data inside the project storage, the attacker needs write access to this project storage. Additionally, the manipulated project needs to be opened by the host application. It depends on the host application whether opening the project requires a user action or not. In fdtCONTAINER applications, the user has to open the manipulated project file manually. In the case of opening a stored project, the deserialization of the manipulated data can be exploited.
- VDE-2021-001Pepperl+Fuchs: Vulnerability allowing code-excution in PACTware <=5.0.5.312021-01-15csaf · pepperl_fuchs_psirtDE
A critical vulnerability has been discovered in the fdtCONTAINER component by M&M Software GmbH used by PACTware. While de-serializing PACTware 5 project files (loading PW5 files) the vulnerability can be exploited to execute arbitrary code.
- VDE-2021-002Weidmueller: WI Manager affected by fdtContainer vulnerability2021-01-20csaf · weidmueller_psirtDE
A vulnerability has been discovered in the fdtCONTAINER component and application by M&M Software GmbH. As this software is part of the Weidmüller FDT/DTM Software with WI Manager, this Weidmueller software is affected by the above vulnerability as well. The fdtCONTAINER component exchanges binary data blobs with the WI Manager. The WI Manager saves these binary data blobs into a project file. If an attacker gets write access to the project file, the project file can be manipulated to contain malicious code.
- VDE-2021-005Endress+Hauser: Multiple Devices affected by fdtContainer vulnerability2021-03-01csaf · endress_hauser_psirtDE
The fdtCONTAINER component is integrated into an application (host application). The fdtCONTAINER application is a specific host application which integrates the fdtCONTAINER component. The fdtCONTAINER component exchanges binary data blobs with such a host application. Typically, the host application saves these binary data blobs into a project storage (project file or a project database). To manipulate the data inside the project storage, the attacker needs write access to this project storage. Additionally, the manipulated project needs to be opened by the host application. It depends on the host application whether opening the project requires a user action or not. In fdtCONTAINER applications, the user has to open the manipulated project file manually. In the case of opening a stored project, the deserialization of the manipulated data can be exploited.
- ICSA-21-021-05WAGO M&M Software fdtCONTAINER (Update C)2021-01-21icsa · cisa_csaf_otUS
If an attacker can socially engineer a valid user into loading a manipulated project file, malicious code can be executed without notice.
- ICSA-21-194-02Schneider Electric Modicon Controllers and Software (Update A)2021-07-13icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow arbitrary code execution and loss of confidentiality and integrity of the project file.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (10)
External citations — patches, advisories, analysis.
- https://cert.vde.com/en-us/advisories/vde-2020-038cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-12525cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-021-05cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.0262/cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2406cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021071415cnnvd
- https://cert.vde.com/en-us/advisories/vde-2020-038enisa_euvd
- https://us-cert.cisa.gov/ics/advisories/icsa-21-021-05enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan