CVE-2020-12001
Rockwell Automation FactoryTalk Linx CopyRenameProject Directory Traversal Remote Code Execution Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. The parsing mechanism that processes certain file types does not provide input sanitation. This may allow an attacker to use specially crafted files to traverse the file system and modify or expose sensitive data or execute arbitrary code.
FactoryTalk Linx versiones 6.00, 6.10 y 6.11, RSLinx Classic versiones v4.11.00 y anteriores, Connected Components Workbench: versión 12 y anteriores, ControlFLASH: versión 14 y posteriores, ControlFLASH Plus: versión 1 y posteriores, FactoryTalk Asset Center: versión 9 y posteriores , FactoryTalk Linx CommDTM: versión 1 y posteriores, Studio 5000 Launcher: versión 31 y posteriores a Stud, software 5000 Logix Designer: versión 32 y anteriores son vulnerables. El mecanismo de análisis que procesa determinados tipos de archivos no proporciona un saneamiento de entrada. Esto puede permitir a un atacante usar archivos especialmente diseñados para atravesar el sistema de archivos y modificar o exponer datos confidenciales o ejecutar código arbitrario
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Studio 5000. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of the CopyRenameProject parameter provided to hmi_isapi.dll. The issue results from the lack of proper validation of user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-04-21 CVE Reserved
- 2020-06-15 CVE Published
- 2024-08-04 CVE Updated
- 2024-10-09 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://www.us-cert.gov/ics/advisories/icsa-20-163-02 | Third Party Advisory | |
| https://www.zerodayinitiative.com/advisories/ZDI-20-733 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rockwellautomation Search vendor "Rockwellautomation" | Factorytalk Linx Search vendor "Rockwellautomation" for product "Factorytalk Linx" | 6.00 Search vendor "Rockwellautomation" for product "Factorytalk Linx" and version "6.00" | - |
Affected
| ||||||
| Rockwellautomation Search vendor "Rockwellautomation" | Factorytalk Linx Search vendor "Rockwellautomation" for product "Factorytalk Linx" | 6.10 Search vendor "Rockwellautomation" for product "Factorytalk Linx" and version "6.10" | - |
Affected
| ||||||
| Rockwellautomation Search vendor "Rockwellautomation" | Factorytalk Linx Search vendor "Rockwellautomation" for product "Factorytalk Linx" | 6.11 Search vendor "Rockwellautomation" for product "Factorytalk Linx" and version "6.11" | - |
Affected
| ||||||
| Rockwellautomation Search vendor "Rockwellautomation" | Rslinx Classic Search vendor "Rockwellautomation" for product "Rslinx Classic" | <= 4.11.00 Search vendor "Rockwellautomation" for product "Rslinx Classic" and version " <= 4.11.00" | - |
Affected
| ||||||