CVE-2020-12029criticalCWE-20

CVE-2020-12029: critical vulnerability in Rockwell Automation FactoryTalk View SE

Rockwell Automation FactoryTalk View SE

Published · Updated

Follow this CVE+ Monitor FactoryTalk View SE

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

75Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 9epss 47%
from disclosure to weaponsame day
Published on NVDJul 20
metasploitJun 22
All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected products
Rockwell Automation · FactoryTalk View SE
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Rockwell Automation FactoryTalk View SE

In the same product, most dangerous first.

CVE-2020-12028HIGHRockwell Automation FactoryTalk View SEEPSS 53.0%CVE-2020-12027MEDIUMRockwell Automation FactoryTalk View SEEPSS 53.0%CVE-2020-12031HIGHRockwell Automation FactoryTalk View SEEPSS 0.6%CVE-2020-14480MEDIUMCVE-2020-14480EPSS 0.3%CVE-2020-14481HIGHCVE-2020-14481EPSS 0.2%