CVE-2020-12015

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-502

Affected software

Vendor	Product	Versions
Mitsubishi Electric	MC Works64	version 4.02C (10.95.208.31) and earlier; all versions
Mitsubishi Electric	MC Works32	version 3.00A (9.50.255.02)
ICONICS	GenBroker64, Platform Services, Workbench, FrameWorX Server	version 10.96 and prior
ICONICS	GenBroker32	version 9.5 and prior

References

https://www.us-cert.gov/ics/advisories/icsa-20-170-02Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-20-170-03Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-20-170-02Third Party Advisory, US Government Resource
https://www.us-cert.gov/ics/advisories/icsa-20-170-03Third Party Advisory, US Government Resource

Timeline

Published: Jul 16, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-120169.8Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5,CVE-2020-120179.8GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web app CVE-2020-120187.5Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorize CVE-2020-120199.8WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbit CVE-2020-12027.8An elevation of privilege vulnerability exists when the Diagnostics Hub Standard Collector or the Visual Studio Standard Collector fail to p CVE-2020-120206.1Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative CVE-2020-120219.0In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting att CVE-2020-120229.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker t CVE-2020-120234.5Philips IntelliBridge Enterprise (IBE), Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSigns (VS4), EarlyVue CVE-2020-120246.1Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the CVE-2020-120253.3Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, wh CVE-2020-120268.8Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a lo