PT-2020-13001 · Rockwell Automation · Studio 5000 Logix Designer+4

Published 2020-05-20 · Updated 2020-05-25 · CVE-2020-12034

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions FactoryTalk Linx software versions 6.00 through 6.11 RSLinx Classic version 4.11.00 and prior RSNetWorx software version 28.00.00 and prior Studio 5000 Logix Designer software version 32 and prior EDS Subsystem version 28.0.1 and prior

Description The EDS subsystem does not provide adequate input sanitation, which may allow an attacker to craft specialized EDS files to inject SQL queries and manipulate the database storing the EDS files. This can lead to denial-of-service conditions.

Recommendations For FactoryTalk Linx software versions 6.00 through 6.11, update to a version later than 6.11 to resolve the issue. For RSLinx Classic version 4.11.00 and prior, update to a version later than 4.11.00 to resolve the issue. For RSNetWorx software version 28.00.00 and prior, update to a version later than 28.00.00 to resolve the issue. For Studio 5000 Logix Designer software version 32 and prior, update to a version later than 32 to resolve the issue. For EDS Subsystem version 28.0.1 and prior, update to a version later than 28.0.1 to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-12034

Affected Products

Eds Subsystem

Factorytalk Linx

Rslinx Classic

Rsnetworx

Studio 5000 Logix Designer

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-12034 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12034 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-20-140-01 · Patch
• https://t.me/cvenotify/3924 · Telegram Post
• https://t.me/cybersecuritytechnologies/1172 · Telegram Post