CVE-2020-12029

Rockwell Automation FactoryTalk View SE

9.0 CriticalPublic exploit

All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: None

Exploit likelihood

47.0%Up 34.9 points since Apr 14, 2021

What each source reports

CVE List Score used 9.0

Rockwell Automation FactoryTalk View SE

Record: CVE-2020-12029
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Weakness: CWE-20
Updated: 2026-11-02

EUVDEUVD-2020-4345 9.0

Record: EUVD-2020-4345
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v98p-v8hm-3f7c No score

All versions of FactoryTalk View SE do not properly validate input of filenames within a project...

Record: GHSA-v98p-v8hm-3f7c
Weakness: CWE-20
Updated: 2026-11-02

NVD 9.0

Record: CVE-2020-12029
CVSS 3.1: 9.0 CriticalCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Rockwell FactoryTalk View SE SCADA Unauthenticated Remote Code Execution	2020-06-22

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12029 is a critical vulnerability (CVSS 9.0) in Rockwell Automation Factorytalk View Se, published July 20, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 47.0%, the 98th percentile. No source names a fixed version.