CVE-2020-12005 : What You Need to Know

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior, Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later, Studio 5000 Logix Designer software: Version 32 and prior are affected by a vulnerability allowing unrestricted upload of files with dangerous types, potentially leading to denial-of-service attacks.

Understanding CVE-2020-12005

This CVE involves a vulnerability in communication functions that enable users to upload EDS files by FactoryTalk Linx, potentially exploited by attackers to cause denial-of-service conditions.

What is CVE-2020-12005?

Vulnerability in communication function allowing file uploads by FactoryTalk Linx
Attackers can upload files with bad compression, consuming CPU resources
Leads to denial-of-service condition

The Impact of CVE-2020-12005

Attackers can exploit the vulnerability to disrupt services and cause denial of service
Potential for significant downtime and operational impact on affected systems

Technical Details of CVE-2020-12005

This section provides technical details of the vulnerability.

Vulnerability Description

Vulnerability allows unrestricted upload of files with dangerous types
Originates from the communication function enabling EDS file uploads by FactoryTalk Linx

Affected Systems and Versions

FactoryTalk Linx versions 6.00, 6.10, and 6.11
RSLinx Classic v4.11.00 and earlier
Connected Components Workbench: Version 12 and prior
ControlFLASH: Version 14 and later
ControlFLASH Plus: Version 1 and later
FactoryTalk Asset Centre: Version 9 and later
FactoryTalk Linx CommDTM: Version 1 and later
Studio 5000 Launcher: Version 31 and later
Studio 5000 Logix Designer software: Version 32 and prior

Exploitation Mechanism

Attackers can upload files with bad compression, leading to denial-of-service conditions
CPU resources can be consumed, impacting system performance

Mitigation and Prevention

Protecting systems from CVE-2020-12005 is crucial.

Immediate Steps to Take

Apply vendor-supplied patches and updates promptly
Implement network segmentation to limit exposure
Monitor system resources for unusual activity

Long-Term Security Practices

Conduct regular security assessments and audits
Educate users on safe file upload practices
Keep systems and software up to date
Employ intrusion detection and prevention systems
Backup critical data regularly
Implement access controls and least privilege principles

Patching and Updates

Regularly check for security updates from the vendor
Apply patches as soon as they are available to mitigate the vulnerability