CVE-2020-12003

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. An exposed API call allows users to provide files to be processed without sanitation. This may allow an attacker to use specially crafted requests to traverse the file system and expose sensitive data on the local hard drive.

• CWE-22
• CWE-22

• https://www.us-cert.gov/ics/advisories/icsa-20-163-02Third Party Advisory, US Government Resource
• https://www.us-cert.gov/ics/advisories/icsa-20-163-02Third Party Advisory, US Government Resource

Published

Jun 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11998A regression has been introduced in the commit preventing JM…9.8
• CVE-2020-11999FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…8.1
• CVE-2020-1200<p>A remote code execution vulnerability exists in Microsoft…8.6
• CVE-2020-12000The affected product is vulnerable to the handling of serial…7.5
• CVE-2020-12001FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…9.8
• CVE-2020-12002Advantech WebAccess Node, Version 8.4.4 and prior, Version 9…9.8
• CVE-2020-12004The affected product lacks proper authentication required to…7.5
• CVE-2020-12005FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Class…7.5
• CVE-2020-12006Advantech WebAccess Node, Version 8.4.4 and prior, Version 9…9.8
• CVE-2020-12007A specially crafted communication packet sent to the affecte…9.8
• CVE-2020-12008Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix E…7.5
• CVE-2020-12009A specially crafted communication packet sent to the affecte…7.5