CVE-2020-12005: rockwellautomation factorytalk_linx

Vulnerability summary

CVE-2020-12005 is a high (CVSS 7.8) vulnerability in rockwellautomation factorytalk_linx. EPSS estimates a 1.84% chance of exploitation in the next 30 days, higher than 78.7% of scored vulnerabilities.

Timeline

1. 15-06-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. A vulnerability exists in the communication function that enables users to upload EDS files by FactoryTalk Linx. This may allow an attacker to upload a file with bad compression, consuming all the available CPU resources, leading to a denial-of-service condition.

• CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.