CVE-2020-12013
16.07.2020, 22:15
A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior.
| Vendor | Product | Version |
|---|---|---|
| mitsubishielectric | mc_works32 | 9.50.255.02 |
| mitsubishielectric | mc_works64 | 𝑥 ≤ 10.95.208.31 |
| iconics | energy_analytix | - |
| iconics | facility_analytix | - |
| iconics | genesis64 | - |
| iconics | hyper_historian | - |
| iconics | mobilehmi | - |
| iconics | quality_analytix | - |
| iconics | smart_energy_analytix | - |
| iconics | bizviz | - |
| iconics | genesis32 | - |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-94 - Improper Control of Generation of Code ('Code Injection')The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.