CVE-2020-12485

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The frame touch module does not make validity judgments on parameter lengths when processing specific parameters,which caused out of the boundary when memory access.The vulnerability eventually leads to a local DOS on the device.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
vivo	The frame touch module	>= unspecified, < PD2012_1.4.0; >= unspecified, < PD1965EF_EX_EU_4.4.0; >= unspecified, < PD2001F_EX_1.6.0; >= unspecified, < PD1968F_EX_1.10.1; >= unspecified, < PD1962_1.7.6; >= unspecified, < PD1981_1.5.0; >= unspecified, < PD2006F_EX_1.6.2

References

https://www.vivo.com/en/support/security-advisory-detail?id=2Vendor Advisory
https://www.vivo.com/en/support/security-advisory-detail?id=2Vendor Advisory

Timeline

Published: Nov 10, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-124877.0Due to the flaws in the verification of input parameters, the attacker can input carefully constructed commands to make the ABE service exec CVE-2020-124885.5The attacker can access the sensitive information stored within the jovi Smart Scene module by entering carefully constructed commands witho CVE-2020-12497.8An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory, aka 'Windows Runtime Elevation CVE-2020-124914.8Improper control of framework service permissions with possibility of some sensitive device information leakage.CVE-2020-124921.0Improper handling of WiFi information by framework services can allow certain malicious applications to obtain sensitive information.CVE-2020-1249310.0An open port used for debugging in SWARCOs CPU LS4000 Series with versions starting with G4... grants root access to the device without acce CVE-2020-124945.3Beckhoff's TwinCAT RT network driver for Intel 8254x and 8255x is providing EtherCAT functionality. The driver implements real-time features CVE-2020-124958.8Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) with Firmware version prior to V2.0.0 is prone to improper privilege manag CVE-2020-124966.5Endress+Hauser Ecograph T (Neutral/Private Label) (RSG35, ORSG35) and Memograph M (Neutral/Private Label) (RSG45, ORSG45) with Firmware vers CVE-2020-124977.8PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipul CVE-2020-124987.8mwe file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier is vulnerable to out-of-bounds read remote code exe CVE-2020-124997.3In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files