What is CVE-2020-12025?

CVE-2020-12025 is a low-severity vulnerability in Rockwellautomation Studio_5000_logix_designer, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 3.3/10. Published 2020-07-14.

How severe is CVE-2020-12025?

Low severity. CVSS v3 base score is 3.3 out of 10.

XXE in Rockwellautomation Studio_5000_logix_designer

CVE-2020-12025

Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an attacker to view hostnames or other resources from the program.

Vulnerability class: XXE (XML External Entity)

EPSS: 0.015 (72.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.

Affected products

Rockwellautomation Studio_5000_logix_designer — versions 32.00, 32.01, 32.02
N/a Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, And 32.02 — versions Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02

Weakness classification (CWE)

CWE-611 — Improper Restriction of XML External Entity Reference (XXE)

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-12025?: CVE-2020-12025 is a low-severity vulnerability in Rockwellautomation Studio_5000_logix_designer, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 3.3/10. Published 2020-07-14.
How severe is CVE-2020-12025?: Low severity. CVSS v3 base score is 3.3 out of 10.