CVE-2020-12028: FactoryTalk View SE remote handlers miss permission checks

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.1 with high confidentiality and integrity impact, a public exploit reference, and very high EPSS, but exploitation requires valid credentials and there is no KEV listing.

What it is

FactoryTalk View SE remote contains handlers that do not enforce appropriate permissions, allowing an authenticated attacker to interact with data on the remote endpoint. The flaw is a missing or improper access control issue in an industrial HMI/SCADA product, so it matters for environments where that endpoint is reachable and a low-privilege account exists.

Impact

An attacker with valid credentials gains read and write access to data on the remote endpoint, which can affect the integrity and confidentiality of the HMI/SCADA data. The CVSS vector rates confidentiality and integrity impact as high with no availability impact.

Attack surface

Reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). The description states the attacker must be authenticated, so a valid account is needed before the unprotected handlers can be used.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.53 probability (99th percentile), and a public Packet Storm reference is tagged Exploit. That indicates exploit code or a detailed write-up is publicly available, though the record does not confirm active exploitation in the wild.

What to do

• Apply the vendor fix or upgrade per Rockwell Automation advisory and knowledge base article 1126944; patch first.
• Enable FactoryTalk View SE built-in security features as the vendor recommends.
• Restrict network exposure of the remote endpoint and follow knowledge base articles 109056 and 1126943 to deploy IPSec and/or HTTPS.
• Enforce least privilege and review which accounts can reach the remote handlers, since exploitation requires authentication.
• Monitor and segment the SCADA network so the endpoint is not reachable from general IT or untrusted networks.

Detection

• Review logs for authenticated sessions invoking remote handlers outside normal operator behavior or from unexpected hosts.
• Alert on anomalous read/write activity against FactoryTalk View SE remote data endpoints, especially bulk or off-hours access.
• Audit account usage for low-privilege accounts accessing handlers they do not normally use.
• Monitor network flows to the FactoryTalk View SE remote service for connections from non-engineering segments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.