CVE-2020-12029: FactoryTalk View SE filename validation flaw enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityRemote code execution in a SCADA product with a public exploit and very high EPSS score, though not in KEV and requiring some user interaction per the vector.

What it is

FactoryTalk View SE does not properly validate filenames within a project directory, allowing a crafted file to be executed. The flaw is an improper input validation issue in a widely deployed SCADA HMI product, so successful exploitation can compromise an industrial control environment.

Impact

An attacker can execute arbitrary code on a remote endpoint, gaining the privileges of the affected process and potentially taking control of the HMI or engineering workstation.

Attack surface

The description states the flaw is reachable by a remote, unauthenticated attacker, but the CVSS vector is local with user interaction required (AV:L/UI:R), so the record is internally inconsistent about how it is reached. No authentication is needed per the description, though some user action appears necessary per the vector.

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.46968 (98.8th percentile) and a public exploit reference exists on Packet Storm, indicating exploit code is available.

What to do

• Apply Rockwell Automation patch 1126289, first installing the 06 Apr 2020 or later patch rollup (1066644) as required.
• Restrict network access to FactoryTalk View SE project directories and endpoints to trusted hosts only.
• Limit which users and processes can write files into project directories.
• Monitor vendor advisory 1126944 and CISA ICS advisory ICSA-20-170-05 for updated guidance.

Detection

• Alert on unexpected file creation or modification in FactoryTalk View SE project directories.
• Monitor for processes spawned by FactoryTalk View SE components that are not part of normal operation.
• Review endpoint logs for execution of files originating from project directories.
• Correlate network access to FactoryTalk View SE hosts with file write activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.