CVE-2020-12001: rockwellautomation factorytalk_linx Improper Input Validation
Vulnerability summary
CVE-2020-12001 is a critical (CVSS 9.8) Improper Input Validation vulnerability in rockwellautomation factorytalk_linx. EPSS estimates a 11.50% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities.
Timeline
- 15-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. The parsing mechanism that processes certain file types does not provide input sanitation. This may allow an attacker to use specially crafted files to traverse the file system and modify or expose sensitive data or execute arbitrary code.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
11.50%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 11.50% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Rockwellautomation2 products
- factorytalk_linx6.00 | 6.10 | 6.11
- rslinx_classic≤ 4.11.00
1 vendor · 2 products
References
2 links- www.us-cert.gov/ics/advisories/icsa-20-163-02X Refsource MISCThird Party AdvisoryUS Government Resource