CVE-2020-12003: Path Traversal
First published: Mon Jun 15 2020(Updated: )
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. An exposed API call allows users to provide files to be processed without sanitation. This may allow an attacker to use specially crafted requests to traverse the file system and expose sensitive data on the local hard drive.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwellautomation Factorytalk Linx | =6.00 | |
| Rockwellautomation Factorytalk Linx | =6.10 | |
| Rockwellautomation Factorytalk Linx | =6.11 | |
| Rockwellautomation Rslinx Classic | <=4.11.00 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-12003?
CVE-2020-12003 is a vulnerability found in FactoryTalk Linx versions 6.00, 6.10, and 6.11, as well as RSLinx Classic v4.11.00 and prior.
What is the severity of CVE-2020-12003?
CVE-2020-12003 has a severity rating of 7.5 (high).
Which software versions are affected by CVE-2020-12003?
CVE-2020-12003 affects FactoryTalk Linx versions 6.00, 6.10, and 6.11, as well as RSLinx Classic v4.11.00 and prior.
How can I fix CVE-2020-12003?
To fix CVE-2020-12003, it is recommended to update FactoryTalk Linx to a version higher than 6.11, RSLinx Classic to a version higher than 4.11.00, or apply the necessary patches released by Rockwell Automation.
Where can I find more information about CVE-2020-12003?
More information about CVE-2020-12003 can be found at the following reference: https://www.us-cert.gov/ics/advisories/icsa-20-163-02
- collector/nvd-index
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/rockwellautomation
- canonical/rockwellautomation factorytalk linx
- version/rockwellautomation factorytalk linx/6.00
- version/rockwellautomation factorytalk linx/6.10
- version/rockwellautomation factorytalk linx/6.11
- canonical/rockwellautomation rslinx classic
- version/rockwellautomation rslinx classic/4.11.00