Rockwell Automation FactoryTalk Linx and FactoryTalk Services Platform
Successful exploitation of these vulnerabilities may result in denial-of-service conditions.
beschreibt (4)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-5807US | high7.5 | — | ||
An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics event log. The attacker can specify long f… | ||||
| CVE-2020-5806US | medium5.5 | — | ||
An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll. This can be done by s… | ||||
| CVE-2020-5802US | high7.5 | — | ||
An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TCP port 4241. This wil… | ||||
| CVE-2020-5801US | high7.5 | — | ||
An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDManager::HandleRequest function in RnaDaSvr.… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-21-028-01 JSONself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (5)
- MitigationFactoryTalk Linx software
Confirm the least-privilege user principle is followed and the user/service account access to shared resources (such as a database) is only granted with a minimum number of rights as needed.
- MitigationFactoryTalk Linx software
Confirm the least-privilege user principle is followed and the user/service account access to shared resources (such as a database) is only granted with a minimum number of rights as needed.
- MitigationFactoryTalk Linx software
Confirm the least-privilege user principle is followed and the user/service account access to shared resources (such as a database) is only granted with a minimum number of rights as needed.
- MitigationFactoryTalk Linx software
Confirm the least-privilege user principle is followed and the user/service account access to shared resources (such as a database) is only granted with a minimum number of rights as needed.
- MitigationFactoryTalkServices Platform
Confirm the least-privilege user principle is followed and the user/service account access to shared resources (such as a database) is only granted with a minimum number of rights as needed.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan