CVE-2020-27251
📋 TL;DR
A heap overflow vulnerability in FactoryTalk Linx versions 6.11 and earlier allows remote, unauthenticated attackers to send malicious port ranges that could lead to remote code execution. This affects industrial control systems using Rockwell Automation's FactoryTalk Linx software for communication between devices.
💻 Affected Systems
- FactoryTalk Linx
📦 What is this software?
Factorytalk Linx by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Remote, unauthenticated attacker gains full control of the affected system, potentially compromising industrial processes and safety systems.
Likely Case
Remote code execution leading to system compromise, data theft, or disruption of industrial operations.
If Mitigated
Denial of service or system instability if exploit attempts are blocked but successful execution is prevented.
🎯 Exploit Status
Vulnerability is remotely exploitable without authentication, making it high risk despite lack of public proof-of-concept.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 6.12 or later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130565
Restart Required: Yes
Instructions:
1. Download FactoryTalk Linx version 6.12 or later from Rockwell Automation. 2. Install the update following vendor instructions. 3. Restart affected systems.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FactoryTalk Linx systems from untrusted networks using firewalls and network segmentation.
Port Restriction
allRestrict access to FactoryTalk Linx ports (typically 44818, 2222) to only trusted systems.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FactoryTalk Linx systems
- Deploy intrusion detection systems to monitor for exploit attempts on FactoryTalk ports
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk Linx version in Control Panel > Programs and Features (Windows) or via vendor documentation.Check Version:
Not applicable - check through Windows Programs and Features or vendor toolsVerify Fix Applied:
Verify installed version is 6.12 or later and check that patch installation completed successfully.📡 Detection & Monitoring
Log Indicators:
- Unusual network traffic to FactoryTalk ports (44818, 2222)
- System crashes or instability in FactoryTalk services
Network Indicators:
- Malformed packets to FactoryTalk ports
- Unexpected connections to FactoryTalk services from untrusted sources
SIEM Query:
source_port=44818 OR source_port=2222 AND (malformed_packet=TRUE OR protocol_violation=TRUE)