Rockwell Automation FactoryTalk Linx EDS File unrestricted upload

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Rockwell Automation FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher and 5000 Logix Designer. This vulnerability affects unknown code of the component EDS File Handler. The manipulation leads to unrestricted upload. This vulnerability is documented as CVE-2020-12005. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Rockwell Automation FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher and 5000 Logix Designer (Automation Software) and classified as problematic. This issue affects an unknown functionality of the component EDS File Handler. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is availability. The summary by CVE is:

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. A vulnerability exists in the communication function that enables users to upload EDS files by FactoryTalk Linx. This may allow an attacker to upload a file with bad compression, consuming all the available CPU resources, leading to a denial-of-service condition.

The weakness was released 06/15/2020 (Website). It is possible to read the advisory at us-cert.gov. The identification of this vulnerability is CVE-2020-12005 since 04/21/2020. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1608.002 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-156728, VDB-156729 and VDB-156730. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• Rockwell Automation

Name

• 5000 Logix Designer
• Connected Components Workbench
• ControlFLASH
• ControlFLASH Plus
• FactoryTalk Asset Centre
• FactoryTalk Linx
• FactoryTalk Linx CommDTM
• RSLinx Classic
• Studio 5000 Launcher

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion