CVE-2020-12005: 
Rockwell Automation RSLinx Classic vulnerability analysis and mitigation

CVE-2020-12005 is a vulnerability discovered in FactoryTalk Linx software versions 6.00, 6.10, and 6.11, along with several related products including RSLinx Classic v4.11.00 and prior versions. The vulnerability was disclosed in June 2020 and affects the communication function that enables users to upload Electronic Data Sheet (EDS) files (CISA Advisory).

The vulnerability is classified as an Unrestricted Upload of File with Dangerous Type (CWE-434). It has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it is network-exploitable with low attack complexity and requires no privileges or user interaction (NVD).

When exploited, this vulnerability allows an attacker to upload a file with bad compression to the system, which results in consuming all available CPU resources, ultimately leading to a denial-of-service condition (CISA Advisory).

The vulnerability is remotely exploitable and requires low skill level to exploit. However, there are no known public exploits specifically targeting this vulnerability (CISA Advisory).

Rockwell Automation has released patches to address this vulnerability. Users are recommended to apply these patches through FactoryTalk Linx/Services patch RAID# 1124820 and FactoryTalk Linx patch RAID# 1126433. Additionally, network-based mitigations include blocking all traffic to EtherNet/IP or other CIP protocol-based devices from outside the manufacturing zone by restricting access to TCP Ports 2222, 7153, and UDP Port 44818 using proper network infrastructure controls (CISA Advisory).