CVE-2020-12525
WAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER component
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.5, 3.5.20304.x, 3.6.20304.x, 4.5, 4.5.20304.x, and 1 more
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
Timeline
- CVE published
- Record last updated
Affected versions
- M&M Software fdtCONTAINER Component
fixed in 3.5; From 3.5 · fixed in 3.5.20304.x; From 3.6 · fixed in 3.6.20304.x
- M&M Software fdtCONTAINER Application
fixed in 4.5; From 4.5 · fixed in 4.5.20304.x; From 4.6 · fixed in 4.6.20304.x
- M&M Software dtmlINSPECTOR
3
- Pepperl+Fuchs/PACTware PACTware
through 5.0.5.31
- Weidmüller WI Manager
through 2.5.1