What’s Vulnerable › Vulnerabilities

CVE-2020-12525: WAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER component

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-22 · updated 2026-06-17
• Weakness: CWE-502

Description

M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.

Affected products

• Emerson Rosemount Transmitter Interface Software: all versions
• Pepperl-Fuchs Io-Link Master Firmware: through 1.5.48
• Pepperl-Fuchs Pactware: from 5.0 through 5.0.5.31
• WAGO Dtminspector 3: all versions
• WAGO Fdtcontainer Application: before 4.5; from 4.5.0 through 4.5.20304; from 4.6.0 through 4.6.20304 — fixed in 4.5
• WAGO Fdtcontainer Component: before 3.5; from 3.5.0 through 3.5.20304; from 3.6.0 through 3.6.20304 — fixed in 3.5
• Weidmüller WI Manager: through 2.5.1

How to fix

Upgrade to a fixed version: WAGO Fdtcontainer Application 4.5; WAGO Fdtcontainer Component 3.5. Check the vendor advisory for mitigations.

References

• https://cert.vde.com/en-us/advisories/vde-2020-038
• https://us-cert.cisa.gov/ics/advisories/icsa-21-021-05
• https://cert.vde.com/en-us/advisories/vde-2020-038
• https://us-cert.cisa.gov/ics/advisories/icsa-21-021-05

Get alerted when CVE-2020-12525 or the next vulnerability affects your stack