← Voltar para CVEs

CVE-2020-12031

HIGH

7.5

Descricao

In all versions of FactoryTalk View SE, after bypassing memory corruption mechanisms found in the operating system, a local, authenticated attacker may corrupt the associated memory space allowing for arbitrary code execution. Rockwell Automation recommends applying patch 1126290. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Vetor de ataqueLOCAL

ComplexidadeHIGH

Privilegios necessariosLOW

Interacao do usuarioREQUIRED

Publicado7/20/2020

Ultima modificacao11/21/2024

Fontenvd

Avistamentos honeypot0

Produtos afetados

rockwellautomation:factorytalk_view

Fraquezas (CWE)

CWE-119CWE-787

Referencias

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944(ics-cert@hq.dhs.gov)

https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05(ics-cert@hq.dhs.gov)

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944(af854a3a-2127-422b-91ae-364da2661108)

https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05(af854a3a-2127-422b-91ae-364da2661108)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.