Deserialization in Arcinfo Pcvue
CVE-2020-26867
ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
Vulnerability class: Insecure Deserialization
EPSS: 0.037 (88.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Arcinfo Pcvue
- Arc Informatique Pcvue — versions unspecified
- Arcinformatique Pcvue
- Pcvuesolutions Pcvue
Weakness classification (CWE)
Public proof-of-concept exploits
References
- vulnerability@kaspersky.com (US Government Resource, Third Party Advisory, x_refsource_MISC)
- vulnerability@kaspersky.com (x_refsource_CONFIRM, Vendor Advisory)
- vulnerability@kaspersky.com (x_refsource_CONFIRM, Broken Link)
- vulnerability@kaspersky.com (Vendor Advisory, Permissions Required, x_refsource_CONFIRM)
Frequently asked questions
- What is CVE-2020-26867?
- CVE-2020-26867 is a critical-severity vulnerability in Arcinfo Pcvue, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2020-10-12.
- How severe is CVE-2020-26867?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2020-26867 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.