CVE-2020-12000
Last modified
CVE-2020-12000 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.. EPSS estimates a 1.48% chance of exploitation in the next 30 days.
Description
The affected product is vulnerable to the handling of serialized data. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Inductiveautomation | Ignition Gateway | >= 7.2.4.48, < 7.9.14 |
| Inductiveautomation | Ignition Gateway | >= 8.0, < 8.0.10 |
References
- https://www.us-cert.gov/ics/advisories/icsa-20-147-01Third Party Advisory, US Government Resource
- https://www.us-cert.gov/ics/advisories/icsa-20-147-01Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-12000?
How severe is CVE-2020-12000?
How do I fix CVE-2020-12000?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-11995A deserialization vulnerability existed in dubbo 2.7.5 and i…9.8
- CVE-2020-11996A specially crafted sequence of HTTP/2 requests sent to Apac…7.5
- CVE-2020-11997Apache Guacamole 1.2.0 and earlier do not consistently restr…4.3
- CVE-2020-11998A regression has been introduced in the commit preventing JM…9.8
- CVE-2020-11999FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…8.1
- CVE-2020-1200<p>A remote code execution vulnerability exists in Microsoft…8.6
- CVE-2020-12001FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…9.8
- CVE-2020-12002Advantech WebAccess Node, Version 8.4.4 and prior, Version 9…9.8
- CVE-2020-12003FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…7.5
- CVE-2020-12004The affected product lacks proper authentication required to…7.5
- CVE-2020-12005FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…7.5
- CVE-2020-12006Advantech WebAccess Node, Version 8.4.4 and prior, Version 9…9.8
Are you affected by CVE-2020-12000?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST