Critical severity · published Jun 15, 2020
CVE-2020-12001
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later,…
9.8
CVSS
11.5%
EPSS
No
On KEV
Description
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. The parsing mechanism that processes certain file types does not provide input sanitation. This may allow an attacker to use specially crafted files to traverse the file system and modify or expose sensitive data or execute arbitrary code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)11.5% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FL
Factorytalk Linx · Rockwellautomation
6.00; 6.10; 6.11 · source: NVD
RC
Rslinx Classic · Rockwellautomation
through 4.11.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12001
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12001
Third Party Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-163-02
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-733/
More from Factorytalk Linx
9.8
CVE-2020-27251
A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior
9.1
CVE-2025-7972
Rockwell Automation FactoryTalk® Linx Network Browser Security Bypass Vulnerability
9.1
CVE-2023-29464
Rockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information Disclosure
8.1
CVE-2020-11999
FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later,…
7.8
CVE-2025-9067
Rockwell Automation FactoryTalk® Linx Privilege Escalation Vulnerabilities
