High severity · published Jan 22, 2021
CVE-2020-12525
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage
7.8
CVSS
1.4%
EPSS
No
On KEV
Description
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
D3
Dtminspector 3 · Wago
All versions, or not specified · source: NVD
FA
Fdtcontainer Application · Wago
before 4.5; 4.5.0 through 4.5.20304; 4.6.0 through 4.6.20304 · source: NVD
FC
Fdtcontainer Component · Wago
before 3.5; 3.5.0 through 3.5.20304; 3.6.0 through 3.6.20304 · source: NVD
IM
Io-link Master Firmware · Pepperl-fuchs
through 1.5.48 · source: NVD
PA
Pactware · Pepperl-fuchs
5.0 through 5.0.5.31 · source: NVD
RT
Rosemount Transmitter Interface Software · Emerson
All versions, or not specified · source: NVD
WM
WI Manager · Weidmueller
through 2.5.1 · source: NVD
Affected product
RT
Rosemount Transmitter Interface Software
Emerson