title: WAGO/M&M Software Deserialization of untrusted data in fdtCONTAINER component
description: M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
problem types: CWE-502 Deserialization of Untrusted Data
affected:
{
product: fdtCONTAINER Component
vendor: M&M Software
versions:
lessThan: 3.5, status: affected, version: unspecified, versionType: custom
lessThan: 3.5.20304.x, status: affected, version: 3.5, versionType: custom
lessThan: 3.6.20304.x, status: affected, version: 3.6, versionType: custom
}
{
product: fdtCONTAINER Application
vendor: M&M Software
versions:
lessThan: 4.5, status: affected, version: unspecified, versionType: custom
lessThan: 4.5.20304.x, status: affected, version: 4.5, versionType: custom
lessThan: 4.6.20304.x, status: affected, version: 4.6, versionType: custom
}
{
product: dtmlINSPECTOR
vendor: M&M Software
versions:
status: affected, version: 3
}
{
product: PACTware
vendor: Pepperl+Fuchs/PACTware
versions:
lessThanOrEqual: 5.0.5.31, status: affected, version: unspecified, versionType: custom
}
{
product: WI Manager
vendor: Weidmüller
versions:
lessThanOrEqual: 2.5.1, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: M&M Software provides two updated fdtCONTAINER component trees (3.6.20304.x < 3.7 and >= 3.7) see advisory https://cert.vde.com/en-us/advisories/vde-2020-048 for details.