Vulnerability · Published Jul 20, 2020 · Assigned by icscert

CVE-2020-12029Rockwell Automation FactoryTalk View SE

Critical 9.0

In plain English

A critical-severity improper input validation in FactoryTalk View SE from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 47.0% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)47.0%top 1.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Metasploit

Official description

All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.

Affected products (as reported)

Vendor	Product	Versions
Rockwell Automation	FactoryTalk View SE	all versions

Weakness: CWE-20 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

References

https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05 x_refsource_MISC
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944 x_refsource_MISC
http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Execution.html x_refsource_MISC