Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-12007 State: PUBLISHED Published: 2020-07-16T21:49:12 Last Updated: 2024-08-04T11:48:57.519Z Vendors: Mitsubishi Electric, ICONICS Products: MC Works64, MC Works32, GenBroker64, Platform Services, Workbench, FrameWorX Server, GenBroker32 Problem Types: CWE-502 Description: A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Ser
ubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03 - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02%2C
CVE ID: CVE-2020-12008 State: PUBLISHED Published: 2020-06-29T13:53:25 Last Updated: 2024-08-04T11:48:57.121Z Vendors: n/a Products: Baxter ExactaMix EM 2400 & EM 1200 Problem Types: CWE-319 Description: Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems use cleartext messages to communicate order information with an order entry system. This could allow an attacker with network access to view sensitive data including PHI. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-01
CVE ID: CVE-2020-12009 State: PUBLISHED Published: 2020-07-16T19:39:24.072953Z Last Updated: 2024-09-16T23:00:29.508Z Vendors: Mitsubishi Electric, ICONICS Products: MC Works64, MC Works32, GenBroker64, Platform Services, Workbench, FrameWorX Server, GenBroker32 Problem Types: CWE-502 Description: A specially crafted communication packet sent to the affected device could cause a denial-of-service condition due to a deserialization vulnerability. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICO
2 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03
CVE ID: CVE-2020-12010 State: PUBLISHED Published: 2020-05-08T11:40:22 Last Updated: 2024-08-04T11:48:58.249Z Vendors: n/a Products: Advantech WebAccess Node Problem Types: CWE-23 Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an authenticated user to use a specially crafted file to delete files outside the application’s control. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-128-01
CVE ID: CVE-2020-12011 State: PUBLISHED Published: 2020-07-16T18:53:05 Last Updated: 2024-08-04T11:48:57.125Z Vendors: n/a Products: Mitsubishi Electric MC Works64, MC Works32, ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server, GenBroker32 Problem Types: CWE-787 Description: A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.
02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03
CVE ID: CVE-2020-12012 State: PUBLISHED Published: 2020-06-29T13:54:53 Last Updated: 2024-08-04T11:48:57.903Z Vendors: n/a Products: Baxter ExactaMix EM 2400 & EM 1200 Problem Types: CWE-259 Description: Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13, and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 have hard-coded administrative account credentials for the ExactaMix application. Successful exploitation of this vulnerability may allow an attacker with physical access to gain unauthorized access to view/update system configuration or data. This co
allow an attacker with physical access to gain unauthorized access to view/update system configuration or data. This could impact confidentiality and integrity of the system and risk exposure of sensitive information including PHI. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-01
CVE ID: CVE-2020-12013 State: PUBLISHED Published: 2020-07-16T21:14:34 Last Updated: 2024-08-04T11:48:57.506Z Vendors: Mitsubishi Electric, ICONICS Products: MC Works64, MC Works32, GenBroker64, Platform Services, Workbench, FrameWorX Server, GenBroker32 Problem Types: CWE-94 Description: A specially crafted WCF client that interfaces to the may allow the execution of certain arbitrary SQL commands remotely. This affects: Mitsubishi Electric MC Works64 Version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 Version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior. Addit
GenBroker64, Platform Services, Workbench, FrameWorX Server v10.96 and prior; ICONICS GenBroker32 v9.5 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-02 - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-03
CVE ID: CVE-2020-12014 State: PUBLISHED Published: 2020-05-08T11:46:31 Last Updated: 2024-08-04T11:48:57.629Z Vendors: n/a Products: Advantech WebAccess Node Problem Types: CWE-89 Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-128-01 - https://www.zerodayinitiative.com/advisories/ZDI-20-613/
CVE ID: CVE-2020-12015 State: PUBLISHED Published: 2020-07-16T21:30:43 Last Updated: 2024-08-04T11:48:57.726Z Vendors: Mitsubishi Electric, ICONICS Products: MC Works64, MC Works32, GenBroker64, Platform Services, Workbench, FrameWorX Server, GenBroker32 Problem Types: CWE-502 Description: A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition due to improper deserialization. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier, all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICON
n 3.00A (9.50.255.02); ICONICS GenBroker64, Platform Services, Workbench, FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-170-03 - https://www.us-cert.gov/ics/advisories/icsa-20-170-02
CVE ID: CVE-2020-12016 State: PUBLISHED Published: 2020-06-29T13:54:50 Last Updated: 2024-08-04T11:48:57.993Z Vendors: n/a Products: Baxter ExactaMix EM 2400 & EM 1200 Problem Types: CWE-259 Description: Baxter ExactaMix EM 2400 & EM 1200, Versions ExactaMix EM2400 Versions 1.10, 1.11, 1.13, 1.14, ExactaMix EM1200 Versions 1.1, 1.2, 1.4, 1.5, Baxter ExactaMix EM 2400 Versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 have hard-coded administrative account credentials for the ExactaMix operating system. Successful exploitation of this vulnerability may allow an attacker who has gained unauthorized access to system resources, including access to execute softwar
bility may allow an attacker who has gained unauthorized access to system resources, including access to execute software or to view/update files, directories, or system configuration. This could allow an attacker with network access to view sensitive data including PHI. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-01
CVE ID: CVE-2020-12017 State: PUBLISHED Published: 2020-06-02T18:31:05 Last Updated: 2024-08-04T11:48:58.016Z Vendors: n/a Products: GE Grid Solutions Reason RT Clocks Problem Types: CWE-306 Description: GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacker to execute arbitrary commands and send a request to a specific URL that could cause the device to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allo
e to become unresponsive. The unauthenticated attacker may change the password of the 'configuration' user account, allowing the attacker to modify the configuration of the device via the web interface using the new password. This vulnerability may also allow an unauthenticated attacker to bypass the authentication required to configure the device and reboot the system. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-154-05
CVE ID: CVE-2020-12018 State: PUBLISHED Published: 2020-05-08T11:51:50 Last Updated: 2024-08-04T11:48:57.609Z Vendors: n/a Products: Advantech WebAccess Node Problem Types: CWE-125 Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorized data. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-128-01 - https://www.zerodayinitiative.com/advisories/ZDI-20-628/
CVE ID: CVE-2020-12019 State: PUBLISHED Published: 2020-06-15T19:08:06 Last Updated: 2024-08-04T11:48:57.802Z Vendors: n/a Products: WebAccess Node Problem Types: CWE-121 Description: WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-161-01
CVE ID: CVE-2020-12020 State: PUBLISHED Published: 2020-06-29T13:51:49 Last Updated: 2024-08-04T11:48:57.381Z Vendors: n/a Products: Baxter ExactaMix EM 2400 & EM 1200 Problem Types: CWE-668 Description: Baxter ExactaMix EM 2400 Versions 1.10, 1.11, and 1.13 and ExactaMix EM1200 Versions 1.1, 1.2, and 1.4 does not restrict non administrative users from gaining access to the operating system and editing the application startup script. Successful exploitation of this vulnerability may allow an attacker to alter the startup script as the limited-access user. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-01
CVE ID: CVE-2020-12021 State: PUBLISHED Published: 2020-06-23T21:36:23 Last Updated: 2024-08-04T11:48:57.978Z Vendors: n/a Products: OSIsoft PI Web API 2019 Problem Types: CWE-79 Description: In OSIsoft PI Web API 2019 Patch 1 (1.12.0.6346) and all previous versions, the affected product is vulnerable to a cross-site scripting attack, which may allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-163-01
CVE ID: CVE-2020-12022 State: PUBLISHED Published: 2020-05-08T11:38:54 Last Updated: 2024-08-04T11:48:57.655Z Vendors: n/a Products: Advantech WebAccess Node Problem Types: CWE-129 Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-128-01 - https://www.zerodayinitiative.com/advisories/ZDI-20-598/
CVE ID: CVE-2020-12023 State: PUBLISHED Published: 2020-06-11T19:11:03 Last Updated: 2025-06-04T22:02:51.755Z Severity: LOW (CVSS 2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Philips Products: IntelliBridge Enterprise (IBE) Problem Types: CWE-532 Description: Philips IntelliBridge Enterprise (IBE), Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSigns (VS4), EarlyVue (VS30) and IntelliVue Guardian (IGS). Unencrypted user credentials received in the IntelliBridge Enterprise (IBE) are logged within the transaction logs, which are secured behind the login based administrative web portal. The unencrypted user credentials sent from the affected products l
red behind the login based administrative web portal. The unencrypted user credentials sent from the affected products listed above, for the purpose of handshake or authentication with the Enterprise Systems, are logged as the payload in IntelliBridge Enterprise (IBE) within the transaction logs. An attacker with administrative privileges could exploit this vulnerability to read plain text credentials from log files. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-163-01 - https://www.philips.com/a-w/security/security-advisories/product-security-2020.html#2020_archive
CVE ID: CVE-2020-12024 State: PUBLISHED Published: 2020-06-29T13:51:31 Last Updated: 2024-08-04T11:48:58.000Z Vendors: n/a Products: Baxter ExactaMix EM 2400 & EM 1200 Problem Types: CWE-284 Description: Baxter ExactaMix EM 2400 versions 1.10, 1.11, 1.13, 1.14 and ExactaMix EM1200 Versions 1.1, 1.2, 1.4 and 1.5 does not restrict access to the USB interface from an unauthorized user with physical access. Successful exploitation of this vulnerability may allow an attacker with physical access to the system the ability to load an unauthorized payload or unauthorized access to the hard drive by booting a live USB OS. This could impact confidentiality and integrity of the system and risk exposure
the hard drive by booting a live USB OS. This could impact confidentiality and integrity of the system and risk exposure of sensitive information including PHI. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-01
CVE ID: CVE-2020-12025 State: PUBLISHED Published: 2020-07-14T12:44:30 Last Updated: 2024-08-04T11:48:57.991Z Vendors: n/a Products: Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 Problem Types: CWE-611 Description: Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an attacker to view hostnames or other resources from the program. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-191-02
CVE ID: CVE-2020-12026 State: PUBLISHED Published: 2020-05-08T11:48:19 Last Updated: 2024-08-04T11:48:57.082Z Vendors: n/a Products: Advantech WebAccess Node Problem Types: CWE-23 Description: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-128-01 - https://www.zerodayinitiative.com/advisories/ZDI-20-626/
CVE ID: CVE-2020-12027 State: PUBLISHED Published: 2020-07-20T15:13:36.859679Z Last Updated: 2024-09-17T04:29:36.048Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Rockwell Automation Products: FactoryTalk View SE Problem Types: CWE-200 Description: All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to leverage this information for reconnaissance efforts. Rockwell Automation recommends enabling built in security features found within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and
actoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and/or HTTPs. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944 - http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2020-12028 State: PUBLISHED Published: 2020-07-20T15:17:11.738641Z Last Updated: 2024-09-16T23:26:08.043Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: Rockwell Automation Products: FactoryTalk View SE Problem Types: CWE-264 Description: In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions. Rockwell Automation recommends enabling built in security features found within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up
within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and/or HTTPs. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944 - http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2020-12029 State: PUBLISHED Published: 2020-07-20T14:56:42.195322Z Last Updated: 2024-09-16T22:02:56.282Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) Vendors: Rockwell Automation Products: FactoryTalk View SE Problem Types: CWE-20 Description: All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Rol
1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944 - http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Execution.html
CVE ID: CVE-2020-12030 State: PUBLISHED Published: 2021-09-29T19:36:38 Last Updated: 2024-08-04T11:48:57.679Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Emerson Products: Wireless 1410 Gateway, Wireless 1420 Gateway, Wireless 1552WU Gateway Problem Types: CWE-284 Description: There is a flaw in the code used to configure the internal gateway firewall when the gateway's VLAN feature is enabled. If a user enables the VLAN setting, the internal gateway firewall becomes disabled resulting in exposure of all ports used by the gateway. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-135-02
CVE ID: CVE-2020-12031 State: PUBLISHED Published: 2020-07-20T15:10:06.923367Z Last Updated: 2024-09-16T16:48:08.622Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Rockwell Automation Products: FactoryTalk View SE Problem Types: CWE-119 Description: In all versions of FactoryTalk View SE, after bypassing memory corruption mechanisms found in the operating system, a local, authenticated attacker may corrupt the associated memory space allowing for arbitrary code execution. Rockwell Automation recommends applying patch 1126290. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx. Addit
ing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx. Additional Analyst Notes: - CVE Program Container: References: - https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05 - https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944
CVE ID: CVE-2020-12032 State: PUBLISHED Published: 2020-06-29T13:53:23 Last Updated: 2024-08-04T11:48:57.903Z Vendors: n/a Products: Baxter ExactaMix EM 2400 & EM 1200 Problem Types: CWE-311 Description: Baxter ExactaMix EM 2400 Versions 1.10, 1.11 and ExactaMix EM1200 Versions 1.1, 1.2 systems store device data with sensitive information in an unencrypted database. This could allow an attacker with network access to view or modify sensitive data including PHI. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsma-20-170-01
CVE ID: CVE-2020-12033 State: PUBLISHED Published: 2020-06-23T21:45:14 Last Updated: 2024-08-04T11:48:57.627Z Vendors: n/a Products: Rockwell Automation FactoryTalk Services Platform Problem Types: CWE-20 Description: In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not validate supplied identifiers, which could allow an unauthenticated, adjacent attacker to execute remote COM objects with elevated privileges. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-170-04
CVE ID: CVE-2020-12034 State: PUBLISHED Published: 2020-05-20T02:38:00 Last Updated: 2024-08-04T11:48:57.791Z Vendors: n/a Products: EDS Subsystem, FactoryTalk Linx software (Previously called RSLinx Enterprise), RSLinx Classic, RSNetWorx software, Studio 5000 Logix Designer software Problem Types: CWE-89 Description: Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and prior) is vulnerable.The EDS subsystem does not provide adequate input sanitation,
gix Designer software: Version 32 and prior) is vulnerable.The EDS subsystem does not provide adequate input sanitation, which may allow an attacker to craft specialized EDS files to inject SQL queries and manipulate the database storing the EDS files. This can lead to denial-of-service conditions. Additional Analyst Notes: - CVE Program Container: References: - https://www.us-cert.gov/ics/advisories/icsa-20-140-01