CVE-2020-12003: 
Rockwell Automation RSLinx Classic vulnerability analysis and mitigation

CVE-2020-12003 is a path traversal vulnerability affecting FactoryTalk Linx versions 6.00, 6.10, and 6.11, along with several related products including Connected Components Workbench, ControlFLASH, FactoryTalk Asset Centre, and Studio 5000 Logix Designer software. The vulnerability was discovered and reported by Sharon Brizinov and Amir Preminger of Claroty to Rockwell Automation and CISA, with public disclosure in June 2020 (CISA Advisory).

The vulnerability is classified as an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability, identified as CWE-22. An exposed API call allows users to provide files to be processed without proper sanitation. The vulnerability has been assigned a CVSS v3 base score of 7.5 (High severity) with the vector string (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating it is network exploitable with low attack complexity and requires no privileges or user interaction (CISA Advisory).

Successful exploitation of this vulnerability allows an attacker to use specially crafted requests to traverse the file system and expose sensitive data on the local hard drive. The vulnerability affects critical infrastructure sectors including Critical Manufacturing, Energy, and Water and Wastewater Systems worldwide (CISA Advisory).

The vulnerability is remotely exploitable with low skill level required to exploit. No known public exploits specifically targeting this vulnerability have been reported (CISA Advisory).

Rockwell Automation has released patches to address this vulnerability, available through their knowledgebase articles (FactoryTalk Linx/Services patch RAID# 1124820 and FactoryTalk Linx patch RAID# 1126433). Additional recommended mitigations include blocking all traffic to EtherNet/IP or other CIP protocol-based devices from outside the manufacturing zone by restricting access to TCP Ports 2222, 7153, and UDP Port 44818 using proper network infrastructure controls. Organizations should also locate control system networks behind firewalls and isolate them from the business network (CISA Advisory).