CVE-2020-12525 : M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deser

M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.

Published 2021-01-22 19:15:12

Updated 2022-02-10 17:57:58

Source CERT VDE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-12525

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 37 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-12525

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.3	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H	1.3	5.9	CERT VDE
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-12525

CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

Assigned by:

info@cert.vde.com (Secondary)
nvd@nist.gov (Primary)

References for CVE-2020-12525

https://us-cert.cisa.gov/ics/advisories/icsa-21-021-05

WAGO M&M Software fdtCONTAINER | CISA
Third Party Advisory;US Government Resource
https://cert.vde.com/en-us/advisories/vde-2020-038

PEPPERL+FUCHS: Multiple vulnerabilites in Comtrol IO-Link Master. Affected versions <= 1.5.48 — English (USA)
Not Applicable;Third Party Advisory

CVEs referencing this url

Products affected by CVE-2020-12525

Emerson » Rosemount Transmitter Interface Software » Version: N/A
cpe:2.3:a:emerson:rosemount_transmitter_interface_software:-:*:*:*:*:*:*:*
Matching versions
Wago » Dtminspector 3 » Version: N/A
cpe:2.3:a:wago:dtminspector_3:-:*:*:*:*:*:*:*
Matching versions
Wago » Fdtcontainer Application
Versions from including (>=) 4.6.0 and up to, including, (<=) 4.6.20304
cpe:2.3:a:wago:fdtcontainer_application:*:*:*:*:*:*:*:*
Matching versions
Wago » Fdtcontainer Application
Versions before (<) 4.5
cpe:2.3:a:wago:fdtcontainer_application:*:*:*:*:*:*:*:*
Matching versions
Wago » Fdtcontainer Application
Versions from including (>=) 4.5.0 and up to, including, (<=) 4.5.20304
cpe:2.3:a:wago:fdtcontainer_application:*:*:*:*:*:*:*:*
Matching versions
Wago » Fdtcontainer Component
Versions from including (>=) 3.6.0 and up to, including, (<=) 3.6.20304
cpe:2.3:a:wago:fdtcontainer_component:*:*:*:*:*:*:*:*
Matching versions
Wago » Fdtcontainer Component
Versions before (<) 3.5
cpe:2.3:a:wago:fdtcontainer_component:*:*:*:*:*:*:*:*
Matching versions
Wago » Fdtcontainer Component
Versions from including (>=) 3.5.0 and up to, including, (<=) 3.5.20304
cpe:2.3:a:wago:fdtcontainer_component:*:*:*:*:*:*:*:*
Matching versions
Pepperl-fuchs » Io-link Master Firmware
Versions up to, including, (<=) 1.5.48
cpe:2.3:o:pepperl-fuchs:io-link_master_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Pepperl-fuchs » Io-link Master 4-eip » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master 4-pnio » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master 8-eip » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master 8-eip-l » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master 8-pnio » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master 8-pnio-l » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master Dr-8-eip » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master Dr-8-eip-p » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master Dr-8-eip-t » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master Dr-8-pnio » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master Dr-8-pnio-p » Version: N/A
When used together with: Pepperl-fuchs » Io-link Master Dr-8-pnio-t » Version: N/A
Pepperl-fuchs » Pactware
Versions from including (>=) 5.0 and up to, including, (<=) 5.0.5.31
cpe:2.3:a:pepperl-fuchs:pactware:*:*:*:*:*:*:*:*
Matching versions
Weidmueller » Wi Manager
Versions up to, including, (<=) 2.5.1
cpe:2.3:a:weidmueller:wi_manager:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-12525

Exploit prediction scoring system (EPSS) score for CVE-2020-12525

CVSS scores for CVE-2020-12525

CWE ids for CVE-2020-12525

References for CVE-2020-12525

Products affected by CVE-2020-12525