Deserialization of Untrusted Data in fdtCONTAINER component and fdtCONTAINER application - CVE-2020-12525

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU49956

Deserialization of Untrusted Data in fdtCONTAINER component and fdtCONTAINER application - CVE-2020-12525

Published: January 22, 2021 / Updated: January 25, 2021


Vulnerability identifier: #VU49956
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-12525
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
fdtCONTAINER component
fdtCONTAINER application
Software vendor:
M&M Software

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote authenticated attacker can use a specially crafted project file and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

This vulnerability affects the following versions:

  • fdtCONTAINER component
    • Versions between 3.5.0 and 3.5.20304.x
    • Versions between 3.6.0 and 3.6.20304.x
    • Versions older than 3.5
  • fdtCONTAINER application
    • Versions between 4.5.0 and 4.5.20304.x
    • Versions between 4.6.0 and 4.6.20304.x
    • Versions older than 4.5
  • dtmINSPECTOR Version 3 (Based on FDT 1.2.x)

Remediation

Install updates from vendor's website.

External links