Vulnerability · Published Jul 20, 2020 · Assigned by icscert
CVE-2020-12028Rockwell Automation FactoryTalk View SE
High 7.3
In plain English
A high-severity security flaw in FactoryTalk View SE from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 53.0% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions. Rockwell Automation recommends enabling built in security features found within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and/or HTTPs.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | FactoryTalk View SE | all versions |
Weakness: CWE-264 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N