High ICSA-21-028-01 4 CVEs

Rockwell Automation FactoryTalk Linx and FactoryTalk Services Platform

Published Jan 28, 2021 · Updated Jan 28, 2021

Vendor: Rockwell Automation Product: FactoryTalk Linx software Product: FactoryTalkServices Platform

Summary

Successful exploitation of these vulnerabilities may result in denial-of-service conditions.

Vulnerabilities 4

Unscored —

CVE-2020-5801 EPSS 30%

An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled e…

Dec 29, 2020
Unscored —

CVE-2020-5802 EPSS 45%

An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specia…

Dec 29, 2020
Unscored —

CVE-2020-5806

An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowse…

Dec 29, 2020
Unscored —

CVE-2020-5807 EPSS 39%

An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the Facto…

Dec 29, 2020

Revision history

2021-01-28 #1
ICSA-21-028-01 Rockwell Automation FactoryTalk Linx and FactoryTalk Services Platform

References

ICS Advisory ICSA-21-028-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-028-01
Recommended Practices
https://www.cisa.gov/news-events/ics-advisories/icsa-21-028-01
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B