CVE-2020-12034: SQL Injection
Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and prior) is vulnerable.The EDS subsystem does not provide adequate input sanitation, which may allow an attacker to craft specialized EDS files to inject SQL queries and manipulate the database storing the EDS files. This can lead to denial-of-service conditions.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-12034?
CVE-2020-12034 is a vulnerability found in the EDS Subsystem of Rockwell Automation products.
Which Rockwell Automation products are affected by CVE-2020-12034?
Products that use EDS Subsystem: Version 28.0.1 and prior, FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and prior.
What is the severity of CVE-2020-12034?
CVE-2020-12034 has a severity rating of 8.2 (high).
How can I fix CVE-2020-12034?
To fix CVE-2020-12034, it is recommended to update the affected Rockwell Automation products to a version that is not vulnerable.
Where can I find more information about CVE-2020-12034?
You can find more information about CVE-2020-12034 on the official US-CERT website at https://www.us-cert.gov/ics/advisories/icsa-20-140-01.