{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination and support with this publication"
      },
      {
        "organization": "M&M Software GmbH",
        "summary": "reported"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "A critical vulnerability has been discovered in the fdtCONTAINER component by M&M Software GmbH used by PACTware.\nWhile de-serializing PACTware 5 project files (loading PW5 files) the vulnerability can be exploited to execute arbitrary code.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "An attacker might be able to exploit the vulnerability on the workstation running PACTware 5 by supplying/providing a manipulated project file. If that project file is loaded, malicious code can be executed without notice.\n\nFor more information see:\n\nVDE-2020-048: M&M Software (WAGO): Deserialisation of untrusted data in fdtContainer",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Exchange project data only via secure exchange services\nUse appropriate means to protect the project storage from unauthorized\nmanipulation\nDo not open project data from an unknown source\nReduce the user rights of the host application to the necessary minimum",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "A fix for the issue will be provided with PACTware 6 in Q2 2021 which includes the proposed solution by M&M based on FDT Container component version >= 3.6.20304.x.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "cert@pepperl-fuchs.com",
      "name": "Pepperl+Fuchs SE",
      "namespace": "https://www.pepperl-fuchs.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2021-001: Pepperl+Fuchs: Vulnerability allowing code-excution in PACTware <=5.0.5.31 - HTML",
        "url": "https://certvde.com/de/advisories/VDE-2021-001/"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for Pepperl+Fuchs",
        "url": "https://certvde.com/de/advisories/vendor/pepperl+fuchs/"
      },
      {
        "category": "self",
        "summary": "VDE-2021-001: Pepperl+Fuchs: Vulnerability allowing code-excution in PACTware <=5.0.5.31 - CSAF",
        "url": "https://pepperl-fuchs.csaf-tp.certvde.com/.well-known/csaf/white/2021/vde-2021-001.json"
      }
    ],
    "title": "Pepperl+Fuchs: Vulnerability allowing code-excution in PACTware <=5.0.5.31",
    "tracking": {
      "aliases": [
        "VDE-2021-001"
      ],
      "current_release_date": "2025-05-14T12:28:19.000Z",
      "generator": {
        "date": "2024-11-11T09:36:20.221Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.14"
        }
      },
      "id": "VDE-2021-001",
      "initial_release_date": "2021-01-15T12:41:00.000Z",
      "revision_history": [
        {
          "date": "2021-01-15T12:41:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        },
        {
          "date": "2025-05-14T12:28:19.000Z",
          "number": "2",
          "summary": "Fix: version space, added distribution"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "<=5.0.5.31",
                    "product": {
                      "name": "Software PACTware 5.0 <=5.0.5.31",
                      "product_id": "CSAFPID-51001"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "6",
                    "product": {
                      "name": "Software PACTware 5.0 6",
                      "product_id": "CSAFPID-52001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "PACTware"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "Pepperl+Fuchs"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-12525",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 a remote, unauthenticated attacker could make use of hard-coded credentials to gain full access to the device.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-52001"
        ],
        "known_affected": [
          "CSAFPID-51001"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Exchange project data only via secure exchange services\nUse appropriate means to protect the project storage from unauthorized\nmanipulation\nDo not open project data from an unknown source\nReduce the user rights of the host application to the necessary minimum",
          "product_ids": [
            "CSAFPID-51001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "A fix for the issue will be provided with PACTware 6 in Q2 2021 which includes the proposed solution by M&M based on FDT Container component version >= 3.6.20304.x.",
          "product_ids": [
            "CSAFPID-51001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 7.3,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 7.3,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-51001"
          ]
        }
      ],
      "title": "CVE-2020-12525"
    }
  ]
}