{"id":"CVE-2020-26867","aliases":["EUVD-2020-19403","GHSA-7x49-vpw9-2vmr"],"status":"published","title":"ARC Informatique PcVue Deserialization of Untrusted Data","description":"ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03751,"percentile":0.89971,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-502"],"published":"2020-10-12T13:54:47Z","modified":"2026-07-09T18:32:25Z","products":[{"vendor":"arc informatique","product":"pcvue"},{"vendor":"arcinfo","product":"pcvue"}],"references":[{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-20-308-03","tags":["x_refsource_MISC","x_refsource_CONFIRM","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.pcvuesolutions.com/security","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue/","tags":["x_refsource_CONFIRM","x_transferred","Broken Link"]},{"url":"https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1076-security-bulletin-2020-1","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26867"},{"url":"https://www.pcvuesolutions.com/index.php/support-a-services/resources/security-alerts-95138"},{"url":"https://ics-cert.kaspersky.com/advisories/klcert-advisories/2020/10/09/klcert-20-015-remote-code-execution-in-arc-informatique-pcvue"},{"url":"https://github.com/advisories/GHSA-7x49-vpw9-2vmr"}],"sources":{"cve":[{"id":"CVE-2020-26867","title":"ARC Informatique PcVue Deserialization of Untrusted Data","description":"ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.","status":"published","published":"2020-10-12T13:54:47.081Z","modified":"2024-09-16T22:16:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:35:45.763329Z"}],"euvd":[{"id":"EUVD-2020-19403","description":"ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.","status":"published","published":"2020-10-12T13:54:47Z","modified":"2024-09-16T22:16:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:55:04.418269Z"}],"ghsa":[{"id":"GHSA-7x49-vpw9-2vmr","title":"A Remote Code Execution vulnerability exists in PcVue from version 8.10 onward, due to the unsafe...","description":"A Remote Code Execution vulnerability exists in PcVue from version 8.10 onward, due to the unsafe deserialization of messages received on the interface.","status":"published","published":"2022-05-24T17:30:28Z","modified":"2026-07-09T18:32:25Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:09:22.189239Z"}],"nvd":[{"id":"CVE-2020-26867","description":"ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.","status":"published","published":"2020-10-12T14:15:12.26Z","modified":"2026-07-09T18:32:08.463Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:06:19.351389Z"}]}}