Rockwell Automation FactoryTalk Linx API Call path traversal

Summaryinfo

A vulnerability classified as critical was found in Rockwell Automation FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher and 5000 Logix Designer. This affects an unknown part. Executing a manipulation as part of API Call can lead to path traversal. This vulnerability is registered as CVE-2020-12003. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability has been found in Rockwell Automation FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher and 5000 Logix Designer (Automation Software) and classified as critical. This vulnerability affects an unknown function. The manipulation as part of a API Call leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. An exposed API call allows users to provide files to be processed without sanitation. This may allow an attacker to use specially crafted requests to traverse the file system and expose sensitive data on the local hard drive.

The weakness was published 06/15/2020 (Website). The advisory is available at us-cert.gov. This vulnerability was named CVE-2020-12003 since 04/21/2020. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-156728, VDB-156729 and VDB-156731. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Automation Software

Vendor

• Rockwell Automation

Name

• 5000 Logix Designer
• Connected Components Workbench
• ControlFLASH
• ControlFLASH Plus
• FactoryTalk Asset Centre
• FactoryTalk Linx
• FactoryTalk Linx CommDTM
• RSLinx Classic
• Studio 5000 Launcher

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion