CVE-2020-12028

Katalog CVE

CVSS 8.1 · High EPSS 53,0%

Kerentanan Permissions, Privileges, and Access Controls pada rockwellautomation factorytalk view. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions. Rockwell Automation recommends enabling built in security features found within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and/or HTTPs.

Rincian

Terbit di NVD

20 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-264: Permissions, Privileges, and Access Controls
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

53,0% peluang dieksploitasi; lebih tinggi dari 98,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944 advisory vendor
• https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05 advisory pihak ketiga · pemerintah AS
• http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Exe... exploit · advisory pihak ketiga · vdb entry