CVE-2020-12000

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
n/a	Ignition 8 Gateway	versions prior to 7.9.14 and 8.0.10

References

https://www.us-cert.gov/ics/advisories/icsa-20-147-01Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-20-147-01Third Party Advisory, US Government Resource

Timeline

Published: Jun 9, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-120019.8FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-120029.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lac CVE-2020-120037.5FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-120047.5The affected product lacks proper authentication required to query the server on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignit CVE-2020-120057.5FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Cont CVE-2020-120069.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a lo CVE-2020-120079.8A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition du CVE-2020-120087.5Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order info CVE-2020-120097.5A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vuln CVE-2020-12017.8An elevation of privilege vulnerability exists in the way the Windows Now Playing Session Manager handles objects in memory, aka 'Windows No CVE-2020-120107.1Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an a CVE-2020-120119.8A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code executi