CVE-2020-12034
mediumPriorität · verfolgen · 33EPSS 0.013 · 70. PerzentilEUUSEPSS · bewertet 2026-10-27
Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and prior) is vulnerable.The EDS subsystem does not provide adequate input sanitation, which may allow an attacker to craft specialized EDS files to inject SQL queries and manipulate the database storing the EDS files. This can lead to denial-of-service conditions.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationFactoryTalk Linx software (Previously called RSLinx Enterprise)cisa_csaf_ot
Locate control system networks and devices behind firewalls and isolate them from the business network.
- MitigationRSLinx Classiccisa_csaf_ot
Locate control system networks and devices behind firewalls and isolate them from the business network.
- MitigationRSNetWorx softwarecisa_csaf_ot
Locate control system networks and devices behind firewalls and isolate them from the business network.
- MitigationStudio 5000 Logix Designer softwarecisa_csaf_ot
Locate control system networks and devices behind firewalls and isolate them from the business network.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.8–8.2
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (16)
Betroffene Produkte und Versionsbereiche.
- n/a EDS Subsystem, FactoryTalk Linx software (Previously called RSLinx Enterprise), RSLinx Classic, RSNetWorx software, Studio 5000 Logix Designer software≤ EDS Subsystem: Version 28.0.1 and prior, FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and priorenisa_euvdEU
- rockwellautomation eds subsystem≤ 28.0.1nvdUScpe:2.3:a:rockwellautomation:eds_subsystem:*:*:*:*:*:*:*:*
- rockwellautomation rslinx enterprise= 6.00.00nvdUScpe:2.3:a:rockwellautomation:rslinx_enterprise:*:*:*:*:*:*:*:*
- rockwellautomation rslinx enterprise= 6.10.00nvdUScpe:2.3:a:rockwellautomation:rslinx_enterprise:*:*:*:*:*:*:*:*
- rockwellautomation rslinx enterprise= 6.11.00nvdUScpe:2.3:a:rockwellautomation:rslinx_enterprise:*:*:*:*:*:*:*:*
- rockwellautomation studio 5000 logix designer≤ 32.0nvdUScpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-20-140-01Rockwell Automation EDS Subsystem2020-05-19icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could lead to a denial-of-service condition.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (5)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2020-12034cnnvd
- https://www.rockwellautomation.com/Patchcnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-140-01cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-140-01enisa_euvd
- https://www.us-cert.gov/ics/advisories/icsa-20-140-01MitigationPatchThird Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan