CVE-2020-12034
📋 TL;DR
This SQL injection vulnerability in Rockwell Automation's EDS subsystem allows attackers to craft malicious EDS files that can manipulate the database storing these files. Successful exploitation can lead to denial-of-service conditions by corrupting or disrupting the database. Organizations using affected FactoryTalk Linx, RSLinx, RSNetWorx, or Studio 5000 Logix Designer software are at risk.
💻 Affected Systems
- FactoryTalk Linx (formerly RSLinx Enterprise)
- RSLinx Classic
- RSNetWorx
- Studio 5000 Logix Designer
📦 What is this software?
Eds Subsystem by Rockwellautomation
Rslinx by Rockwellautomation
Rslinx Enterprise by Rockwellautomation
Rslinx Enterprise by Rockwellautomation
Rslinx Enterprise by Rockwellautomation
Rsnetworx by Rockwellautomation
Studio 5000 Logix Designer by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of industrial control systems by corrupting the EDS database, potentially causing production downtime and safety issues in operational technology environments.
Likely Case
Denial-of-service affecting device configuration and communication capabilities in industrial networks, requiring database restoration and system downtime.
If Mitigated
Limited impact with proper network segmentation and file validation controls in place, potentially causing minor configuration issues.
🎯 Exploit Status
Requires ability to craft and deliver malicious EDS files to the target system, typically requiring some level of access to the industrial network.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk Linx 6.12, RSLinx Classic 4.12, RSNetWorx 28.01, Studio 5000 Logix Designer 33
Vendor Advisory: https://www.us-cert.gov/ics/advisories/icsa-20-140-01
Restart Required: Yes
Instructions:
1. Download updated software versions from Rockwell Automation Product Compatibility & Download Center. 2. Install updates following vendor documentation. 3. Restart affected systems. 4. Validate EDS database integrity.
🔧 Temporary Workarounds
Restrict EDS File Processing
windowsLimit processing of EDS files to trusted sources only and implement file validation controls.
Network Segmentation
allIsolate affected systems in separate network zones with strict access controls.
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized users from uploading or modifying EDS files.
- Deploy application whitelisting to prevent execution of unauthorized processes that could exploit this vulnerability.
🔍 How to Verify
Check if Vulnerable:
Check installed software versions against affected version lists. Review EDS database for unexpected modifications or corruption.Check Version:
Check version in software About dialog or via Windows Programs and Features for installed Rockwell Automation products.Verify Fix Applied:
Confirm software versions are updated to patched versions. Test EDS file processing with known safe files.📡 Detection & Monitoring
Log Indicators:
- Unusual EDS file processing errors
- Database corruption events in application logs
- Failed SQL queries in database logs
Network Indicators:
- Unexpected EDS file transfers to industrial systems
- Unusual database connection attempts
SIEM Query:
source="rockwell_logs" AND (event_type="EDS_ERROR" OR event_type="DATABASE_CORRUPTION")