CVE-2020-12029
Rockwell Automation FactoryTalk View SE
- State
- Published
- Severity
- 9.0 Critical
- Published
- Jul 20, 2020
- Updated
- Sep 16, 2024
- Reserved
- Apr 21, 2020
Description
All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.0 Critical | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N | icscert |
Weaknesses
- CWE-20 IMPROPER INPUT VALIDATION CWE-20
Affected Products
| Product | Versions |
|---|---|
FactoryTalk View SERockwell Automation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.