PT-2020-13144 · Phoenix Contact · Plcnext Engineer

Amir Preminger · Published 2020-07-21 · Updated 2020-08-05 · CVE-2020-12499

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PLCnext Engineer versions 2020.3.1 and earlier

Description An improper path sanitation issue exists when importing project files, which can lead to potential security issues.

Recommendations For versions 2020.3.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-12499

Affected Products

Plcnext Engineer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-12499 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12499 · Vendor Advisory
• https://cert.vde.com/en-us/advisories/vde-2020-025 · Note