What’s Vulnerable › Vulnerabilities

CVE-2020-12007

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-16 · updated 2026-06-17
• Weakness: CWE-502

Description

A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.

Affected products

• ICONICS Bizviz: all versions
• ICONICS Energy Analytix: all versions
• ICONICS Facility Analytix: all versions
• ICONICS GENESIS32: all versions
• ICONICS and Mitsubishi Electric Corporation GENESIS64: all versions
• ICONICS Hyper Historian: all versions
• ICONICS Mobilehmi: all versions
• ICONICS Quality Analytix: all versions
• ICONICS Smart Energy Analytix: all versions
• Mitsubishielectric Mc Works: through 10.95.208.31
• Mitsubishi Electric MC Works32: 9.50.255.02

References

• https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C
• https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03
• https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C
• https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03

Get alerted when CVE-2020-12007 or the next vulnerability affects your stack