CVE-2020-12034

Vulnerability

The EDS Subsystem (Version 28.0.1 and prior) used in FactoryTalk Linx (versions 6.00, 6.10, 6.11), RSLinx Classic (4.11.00 and prior), RSNetWorx (28.00.00 and prior), and Studio 5000 Logix Designer (version 32 and prior) does not properly sanitize input when processing EDS files. This allows an attacker to inject SQL queries into the database that stores EDS files [1].

Exploitation

An attacker with adjacent network access and no authentication can craft a specialized EDS file containing SQL injection payloads. When the EDS subsystem processes the file, the injected SQL commands are executed against the database. The attack requires no user interaction and has low complexity [1].

Impact

Successful exploitation can lead to denial-of-service (DoS) conditions by manipulating the database. Additionally, the advisory notes that the SQL engine could be manipulated to write or modify files on the system, potentially leading to broader compromise. The CVSS v3 base score is 8.2, with high availability impact [1].

Mitigation

Rockwell Automation has not released a fix as of the advisory date (May 2020). Users are advised to apply defense-in-depth measures, restrict network access, and monitor for unusual EDS file activity. No workaround is provided in the available references [1].