CVE-2020-12001: 
Rockwell Automation RSLinx Classic vulnerability analysis and mitigation

CVE-2020-12001 is a critical vulnerability affecting Rockwell Automation's FactoryTalk Linx Software versions 6.00, 6.10, and 6.11. The vulnerability stems from improper input validation in the parsing mechanism that processes certain file types. This security flaw was discovered and reported by Sharon Brizinov and Amir Preminger of Claroty to Rockwell Automation and CISA. The vulnerability received a CVSS v3 base score of 9.6, indicating its severe nature (CISA Advisory).

The vulnerability is classified as an Improper Input Validation (CWE-20) issue. The parsing mechanism that processes certain file types lacks proper input sanitation, which could allow an attacker to traverse the file system and modify or expose sensitive data or execute arbitrary code. The vulnerability has been assigned a CVSS vector string of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating network accessibility, low attack complexity, and high impact on confidentiality and integrity (ZDI Advisory).

Successful exploitation of this vulnerability could allow attackers to execute arbitrary code on affected installations of Rockwell Automation Studio 5000, traverse the file system, modify or expose sensitive data, and potentially achieve remote code execution. The vulnerability affects critical infrastructure sectors including Critical Manufacturing, Energy, and Water and Wastewater Systems worldwide (CISA Advisory).

Rockwell Automation has released patches to address this vulnerability. Users are recommended to apply these patches through specific knowledgebase articles: FactoryTalk Linx/Services patch RAID# 1124820 and FactoryTalk Linx patch RAID# 1126433. Additional network-based mitigations include blocking all traffic to EtherNet/IP devices from outside the manufacturing zone by restricting access to TCP Ports 2222, 7153, and UDP Port 44818 using proper network infrastructure controls. Organizations should also locate control system networks behind firewalls and isolate them from the business network (CISA Advisory).