Deserialization in Emerson Rosemount Transmitter Interface Software
CVE-2020-12525
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
Vulnerability class: Insecure Deserialization
EPSS: 0.013 (68.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Emerson Rosemount_transmitter_interface_software
- M&m Software Dtmlinspector — versions 3
- M&m Software Fdtcontainer Application — versions unspecified, 4.5, 4.6
- M&m Software Fdtcontainer Component — versions unspecified, 3.5, 3.6
- Pepperl-fuchs Io-link_master_4-eip
- Pepperl-fuchs Io-link_master_4-pnio
- Pepperl-fuchs Io-link_master_8-eip
- Pepperl-fuchs Io-link_master_8-eip-l
- Pepperl-fuchs Io-link_master_8-pnio
- Pepperl-fuchs Io-link_master_8-pnio-l
Weakness classification (CWE)
References
- info@cert.vde.com (x_refsource_CONFIRM, Third Party Advisory, Not Applicable)
- info@cert.vde.com (US Government Resource, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-12525?
- CVE-2020-12525 is a high-severity vulnerability in Emerson Rosemount Transmitter Interface Software, classified under Deserialization of Untrusted Data. CVSS score: 7.3/10. Published 2021-01-22.
- How severe is CVE-2020-12525?
- High severity. CVSS v3 base score is 7.3 out of 10.