« Volver al listado

CVE-2020-12025

Estado: ModificadaBaja (3.3)—

Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an attacker to view hostnames or other resources from the program.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rockwellautomation — Studio 5000 Logix Designer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-12025",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02",
          "versions": [
            {
              "status": "affected",
              "version": "Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-14T13:15:11.343",
  "references": [
    {
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-191-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-20-191-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an attacker to view hostnames or other resources from the program."
    },
    {
      "lang": "es",
      "value": "Rockwell Automation Logix Designer Studio 5000 Versiones 32.00, 32.01 y 32.02, es susceptible a una vulnerabilidad de tipo xml external entity (XXE), que puede permitir a un atacante visualizar nombres de host u otros recursos del programa"
    }
  ],
  "lastModified": "2026-06-17T02:51:16.600",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:32.00:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4083E3F1-AD2E-4A0B-9B19-67D471C25FC6"
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:32.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "53B85CCF-1DD1-4073-9374-F32463416C70"
            },
            {
              "criteria": "cpe:2.3:a:rockwellautomation:studio_5000_logix_designer:32.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16E1A28F-F6F7-4B6B-B0B6-7A3085CB31E2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}