{"id":"CVE-2020-12029","published":"2020-07-20T14:56:42Z","modified":"2024-09-16T22:02:56Z","title":"Rockwell Automation FactoryTalk View SE","vendor":"Rockwell Automation","product":"FactoryTalk View SE","tier":"core","eol":null,"affectedVersions":[{"vendor":"Rockwell Automation","product":"FactoryTalk View SE","versions":["all versions"]}],"description":{"text":"All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.46968,"percentile":0.98826,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05","tags":["x_refsource_MISC"]},{"url":"https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944","tags":["x_refsource_MISC"]},{"url":"http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1133","name":"External Remote Services","tactics":["initial-access","persistence"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"exploitation_technique","evidence":[],"confidence":"high"},{"id":"T1505.003","name":"Web Shell","tactics":["persistence"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"secondary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-4345","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-4345","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution","module":"exploit/windows/scada/rockwell_factorytalk_rce","type":"exploit","disclosureDate":"2020-06-22","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb"}],"first":{"date":"2020-06-22","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1133"],"provenance":"source"},{"stage":"primary","techniques":["T1505.003"],"provenance":"source"},{"stage":"secondary","techniques":["T1059"],"provenance":"source"}],"timeline":[{"date":"2020-06-22","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/scada/rockwell_factorytalk_rce.rb","provenance":"source"},{"date":"2020-07-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-12029","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":31.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.77,"detail":"percentile 0.9883"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}