CVE-2020-26867

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

3.72%

Published

Oct 12, 2020

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-502CWE-502

Affected Products (1)

pcvuesolutions · pcvue (up to 12.0.17)vulnerable

References (10)

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/

Broken Link

https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03

Third Party AdvisoryUS Government Resource

https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03

Third Party AdvisoryUS Government Resource

https://www.pcvuesolutions.com/security

Vendor Advisory

https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1

Permissions RequiredVendor Advisory

https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/

Broken Link

https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03

Third Party AdvisoryUS Government Resource

https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03

Third Party AdvisoryUS Government Resource

https://www.pcvuesolutions.com/security

Vendor Advisory

https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1

Permissions RequiredVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs