Global infos:

Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLinx Classic: Version 4.11.00 and prior, RSNetWorx software: Version 28.00.00 and prior, Studio 5000 Logix Designer software: Version 32 and prior) is vulnerable.The EDS subsystem does not provide adequate input sanitation, which may allow an attacker to craft specialized EDS files to inject SQL queries and manipulate the database storing the EDS files. This can lead to denial-of-service conditions.

CVE Status: Modified

References:

[email protected]

af854a3a-2127-422b-91ae-364da2661108

Metrics:

Attribute	Value
Attack Complexity	LOW
Attack Vector	ADJACENT_NETWORK
Availability Impact	HIGH
Base Score	8.2
Base Severity	HIGH
Confidentiality Impact	NONE
Integrity Impact	LOW
Privileges Required	NONE
Scope	CHANGED
User Interaction	NONE
Vector String	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H
Exploitability Score	2.8
Impact Score	4.7
Source	[email protected]
Type	Primary

Links:

Exploit-db
Github