Description
M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| M&M Software | fdtCONTAINER Component | unspecified – < 3.5, 3.5 – < 3.5.20304.x, 3.6 – < 3.6.20304.x | 3.5 |
| M&M Software | fdtCONTAINER Application | unspecified – < 4.5, 4.5 – < 4.5.20304.x, 4.6 – < 4.6.20304.x | 4.5 |
| M&M Software | dtmlINSPECTOR | 3 | — |
| Pepperl+Fuchs/PACTware | PACTware | unspecified – ≤ 5.0.5.31 | — |
| Weidmüller | WI Manager | unspecified – ≤ 2.5.1 | — |
Advisories 8
- VDE-2021-005 Endress+Hauser: Multiple Devices affected by fdtContainer vulnerability CERT@VDE · May 14, 2025
- VDE-2021-001 Pepperl+Fuchs: Vulnerability allowing code-excution in PACTware <=5.0.5.31 CERT@VDE · May 14, 2025
- VDE-2021-002 Weidmueller: WI Manager affected by fdtContainer vulnerability CERT@VDE · May 14, 2025
- SEVD-2021-194-01 EcoStruxureTM Control Expert, EcoStruxureTM Process Expert, SCADAPack RemoteConnect™ x70, and Modicon Controllers M580 and M340 Schneider Electric CPCERT · Aug 13, 2024
- ICSA-21-194-02 Schneider Electric Modicon Controllers and Software (Update A) CISA ICS & IT advisories · Jul 27, 2021
- ICSA-21-021-05 WAGO M&M Software fdtCONTAINER (Update C) CISA ICS & IT advisories · Jun 17, 2021
- SEVD-2020-252-01 SCADAPack x70 Remote Connect and SCADAPack x70 Security Administrator Schneider Electric CPCERT · Feb 9, 2021
- VDE-2020-048 M&M Software (WAGO): Deserialisation of untrusted data in fdtContainer CERT@VDE · Jan 14, 2021