CVE-2020-12038
mediumPriorität · verfolgen · 23EPSS 0.026 · 85. PerzentilEUUSEPSS · bewertet 2026-10-27
Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and prior) is vulnerable. A memory corruption vulnerability exists in the algorithm that matches square brackets in the EDS subsystem. This may allow an attacker to craft specialized EDS files to crash the EDSParser COM object, leading to denial-of-service conditions.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.
- MitigationFactoryTalk Linx software (Previously called RSLinx Enterprise)cisa_csaf_ot
Locate control system networks and devices behind firewalls and isolate them from the business network.
- MitigationRSLinx Classiccisa_csaf_ot
Locate control system networks and devices behind firewalls and isolate them from the business network.
- MitigationRSNetWorx softwarecisa_csaf_ot
Locate control system networks and devices behind firewalls and isolate them from the business network.
- MitigationStudio 5000 Logix Designer softwarecisa_csaf_ot
Locate control system networks and devices behind firewalls and isolate them from the business network.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (16)
Betroffene Produkte und Versionsbereiche.
- n/a EDS Subsystem, FactoryTalk Linx software (Previously called RSLinx Enterprise), RSLinx Classic, RSNetWorx software, Studio 5000 Logix Designer software≤ EDS Subsystem: Version 28.0.1 and prior, FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and priorenisa_euvdEU
- rockwellautomation eds subsystem≤ 28.0.1nvdUScpe:2.3:a:rockwellautomation:eds_subsystem:*:*:*:*:*:*:*:*
- rockwellautomation rslinx enterprise= 6.00.00nvdUScpe:2.3:a:rockwellautomation:rslinx_enterprise:*:*:*:*:*:*:*:*
- rockwellautomation rslinx enterprise= 6.10.00nvdUScpe:2.3:a:rockwellautomation:rslinx_enterprise:*:*:*:*:*:*:*:*
- rockwellautomation rslinx enterprise= 6.11.00nvdUScpe:2.3:a:rockwellautomation:rslinx_enterprise:*:*:*:*:*:*:*:*
- rockwellautomation studio 5000 logix designer≤ 32.0nvdUScpe:2.3:a:rockwellautomation:studio_5000_logix_designer:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-20-140-01Rockwell Automation EDS Subsystem2020-05-19icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could lead to a denial-of-service condition.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (5)
Externe Belege — Patches, Meldungen, Analysen.
- https://nvd.nist.gov/vuln/detail/CVE-2020-12038cnnvd
- https://www.rockwellautomation.com/Patchcnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-140-01cnnvd
- https://www.us-cert.gov/ics/advisories/icsa-20-140-01enisa_euvd
- https://www.us-cert.gov/ics/advisories/icsa-20-140-01MitigationPatchThird Party AdvisoryUS Government Resourcenvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan