Incorrect permission assignment for critical resource in RSLinx Classic - CVE-2020-10642
Published: June 12, 2020
Vulnerability identifier: #VU28999
CSH Severity: Low
CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2020-10642
CWE-ID: CWE-732
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code on the system.
The vulnerability exists due to insecure permissions. A local user can modify a registry key and execute arbitrary code using system privileges when opening RSLinx Classic.
Affected software
RSLinx Classic
How to mitigate CVE-2020-10642
Vendor recommends to apply patch 1091155 for versions 3.60 to 4.11.