CVE-2020-27255
📋 TL;DR
A heap overflow vulnerability in FactoryTalk Linx versions 6.11 and earlier allows remote unauthenticated attackers to send malicious set attribute requests, potentially leaking sensitive memory information. This information disclosure could help bypass ASLR protections, facilitating further exploitation. Organizations using affected FactoryTalk Linx versions in industrial control systems are at risk.
💻 Affected Systems
- FactoryTalk Linx
📦 What is this software?
Factorytalk Linx by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure leads to ASLR bypass, enabling remote code execution and complete system compromise of industrial control systems.
Likely Case
Remote attackers leak sensitive memory information, potentially exposing credentials, configuration data, or system details that could facilitate further attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to information disclosure without progression to full system compromise.
🎯 Exploit Status
Exploitation requires sending specially crafted set attribute requests to vulnerable systems.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 6.12 or later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1133601
Restart Required: Yes
Instructions:
1. Download FactoryTalk Linx version 6.12 or later from Rockwell Automation. 2. Backup current configuration. 3. Install the update following vendor instructions. 4. Restart affected systems. 5. Verify successful installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate FactoryTalk Linx systems from untrusted networks using firewalls and VLANs.
Access Control Lists
allImplement strict network access controls to limit communication to FactoryTalk Linx systems.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FactoryTalk Linx systems from untrusted networks.
- Deploy intrusion detection systems to monitor for malicious set attribute requests and anomalous network traffic.
🔍 How to Verify
Check if Vulnerable:
Check FactoryTalk Linx version in software properties or using Rockwell Automation diagnostic tools.Check Version:
Check via Windows Programs and Features or FactoryTalk Linx about dialog.Verify Fix Applied:
Verify installed version is 6.12 or later and test system functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual set attribute requests in FactoryTalk Linx logs
- Memory access violations in system logs
Network Indicators:
- Malformed set attribute requests on FactoryTalk Linx ports
- Unusual traffic patterns to FactoryTalk Linx services
SIEM Query:
source="FactoryTalk Linx" AND (event_type="set_attribute" AND size>normal_threshold)