CVE-2020-26867
9.8
CRITICAL · CVSS 3.1 · EPSS 3.8% (pctl 90)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 3.75% — more likely to be exploited than 90% of all CVEs |
| Weakness | CWE-502 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-10-12 |
| Last modified | 2026-07-09 |
Affected (1)
| Vendor | Product |
|---|---|
| arcinfo | pcvue |
References
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://www.pcvuesolutions.com/security
- https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1
- https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03
- https://www.pcvuesolutions.com/security
- https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1
→ the Explorer · watch your stack · NVD