Skip to content
Fencer Vulns
high 8.1

CVE-2020-11999 json

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, Con…

published 2020-06-15 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4315

cvss
8.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.8%
EPSS 2.8% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 14 and later, ControlFLASH Plus: Version 1 and later, FactoryTalk Asset Centre: Version 9 and later, FactoryTalk Linx CommDTM: Version 1 and later, Studio 5000 Launcher: Version 31 and later Stud, 5000 Logix Designer software: Version 32 and prior is vulnerable. An exposed API call allows users to provide files to be processed without sanitation. This may allow an attacker to specify a filename to execute unauthorized code and modify files or data.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-20-163-02 updated cvss 9.6

Rockwell Automation FactoryTalk Linx Software (Update A)

  • Rockwell Automation Connected Components Workbench <= 12 Rockwell Automation ControlFLASH >= 14 Rockwell Automation ControlFLASH Plus >= 1 Rockwell Automation FactoryTalk Asset Centre >= 9 Rockwell Automation FactoryTalk Linx 6.00, 6.10, 6.11 Rockwell Automation FactoryTalk Linx CommDTM >= 1
    +3 more products
    Rockwell Automation RSLinx Classic <= 4.11.00 (Versions removed from the scope of this advisory) Rockwell Automation Studio 5000 Launcher >= 31 Rockwell Automation Studio 5000 Logix Designer software <= 32
    affected: vendor fix, mitigation “Patch Roll-up for CPR9 SRx (Login Required)” rockwellautomation.custhelp.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

2.80% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N

Affected products

  • n/a FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.