CVE-2020-11999: 
Rockwell Automation RSLinx Classic vulnerability analysis and mitigation

CVE-2020-11999 is a security vulnerability affecting FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior, along with several other Rockwell Automation products including Connected Components Workbench, ControlFLASH, FactoryTalk Asset Centre, and Studio 5000 Logix Designer software. The vulnerability was discovered and reported by Sharon Brizinov and Amir Preminger of Claroty to Rockwell Automation and CISA, with public disclosure occurring in June 2020 (CISA Advisory).

The vulnerability is classified as an Improper Input Validation (CWE-20) issue where an exposed API call allows users to provide files to be processed without proper sanitation. The vulnerability has received a CVSS v3.1 base score of 9.6 (Critical) with the vector string AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating it can be exploited remotely with low attack complexity (CISA Advisory).

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized code, modify files or data, and potentially obtain remote code execution on the affected systems. The vulnerability affects critical infrastructure sectors including Critical Manufacturing, Energy, and Water and Wastewater Systems worldwide (CISA Advisory).

The vulnerability is considered to have a low skill level requirement for exploitation and can be accessed remotely. However, as of the advisory publication, no known public exploits specifically targeting this vulnerability have been reported (CISA Advisory).

Rockwell Automation has released patches to address this vulnerability, available through their knowledgebase articles including FactoryTalk Linx/Services patch RAID# 1124820 and FactoryTalk Linx patch RAID# 1126433. Additional network-based mitigations include blocking traffic to EtherNet/IP devices from outside the manufacturing zone by restricting access to TCP Ports 2222, 7153, and UDP Port 44818 using firewalls and other security controls. Organizations are advised to locate control system networks behind firewalls and isolate them from business networks (CISA Advisory).