CVE-2020-12030 : What You Need to Know

Emerson WirelessHART Gateway is affected by a critical vulnerability that could lead to high impact on confidentiality, integrity, and availability.

Understanding CVE-2020-12030

This CVE involves a flaw in the code used to configure the internal gateway firewall when the VLAN feature is enabled, potentially exposing all ports used by the gateway.

What is CVE-2020-12030?

The vulnerability in Emerson WirelessHART Gateway allows the internal gateway firewall to become disabled when the VLAN feature is activated, posing a significant security risk.

The Impact of CVE-2020-12030

The CVSS score for this CVE is 10, indicating a critical severity level with high impacts on confidentiality, integrity, and availability. The attack complexity is low, and no privileges are required for exploitation.

Technical Details of CVE-2020-12030

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The flaw in the gateway's code leads to the firewall being disabled when the VLAN feature is enabled, exposing all gateway ports.

Affected Systems and Versions

Product: Wireless 1410 Gateway
Vendor: Emerson
Affected Version: 4.6.43
Versions Less Than or Equal to: 4.7.84
Product: Wireless 1420 Gateway
Vendor: Emerson
Affected Version: 4.6.43
Versions Less Than or Equal to: 4.7.84
Product: Wireless 1552WU Gateway
Vendor: Emerson
Affected Version: 4.6.43
Versions Less Than or Equal to: 4.7.84

Exploitation Mechanism

The vulnerability can be exploited remotely over a network without user interaction, making it highly dangerous.

Mitigation and Prevention

To address CVE-2020-12030, immediate actions and long-term security practices are essential.

Immediate Steps to Take

Update the firmware on VLAN-enabled Version 4 gateways promptly.
If the VLAN feature is not enabled, no immediate action is required.

Long-Term Security Practices

Regularly monitor and update gateway firmware to prevent vulnerabilities.
Implement network segmentation and access controls to enhance security.

Patching and Updates

Refer to Emerson's cybersecurity notification alert number EMR.RMT20001-1 for detailed patching instructions.