CVE-2020-12499
PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier: Improper path sanitation vulnerability.
- Published
- Updated
- Reserved
- Assigned by
- CERTVDE
Description
In PHOENIX CONTACT PLCnext Engineer version 2020.3.1 and earlier an improper path sanitation vulnerability exists on import of project files.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CERTVDECNA (assigner) | 3.1 | High8.2 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.40% · top 66% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.
Weakness
Affected products
PHOENIX CONTACT · PLCnext Engineer
- affected unspecified – ≤ 2020.3.1
What to do
Solution: Temporary Fix / Mitigation: We strongly recommend customers to exchange project files only using secure file exchange services. Project files should not be exchanged via unencrypted email. Users should avoid importing project files from unknown source and exchange or store project files together with a checksum to ensure their integrity.
Solution: Remediation: Phoenix Contact strongly recommends updating to the latest version PLCnext Enineer 2020.6 or higher, which fixes this vulnerability.
References (1)
- https://cert.vde.com/en-us/advisories/vde-2020-025 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-12499)Record last updated .