CVE-2020-26868
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web Services Toolkit.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 2.15% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-767, CWE-668
- Affected
- arcinfo/pcvue
- Source
- vulnerability@kaspersky.com
References
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-016-denial-of-service-in-arc-informatique-pcvue/Broken Link
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03Third Party Advisory, US Government Resource
- https://www.pcvuesolutions.com/securityVendor Advisory
- https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1Permissions Required, Vendor Advisory
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-016-denial-of-service-in-arc-informatique-pcvue/Broken Link
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03Third Party Advisory, US Government Resource
- https://www.pcvuesolutions.com/securityVendor Advisory
- https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1Permissions Required, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.