CVE-2020-5807
📋 TL;DR
An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted data to FactoryTalk Diagnostics on TCP port 5241, causing an unhandled exception when a local user views the malicious log entry in FactoryTalk Diagnostics Viewer. This affects all versions of FactoryTalk Diagnostics 6.11 and earlier, potentially allowing denial of service or arbitrary code execution.
💻 Affected Systems
- FactoryTalk Diagnostics
📦 What is this software?
Factorytalk Diagnostics by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, though this requires additional exploitation beyond the documented unhandled exception.
Likely Case
Denial of service through application crash when a legitimate user attempts to view malicious log entries in FactoryTalk Diagnostics Viewer.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized access to port 5241.
🎯 Exploit Status
Exploitation requires sending data to port 5241 and a local user opening FactoryTalk Diagnostics Viewer to view the malicious log entry.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk Diagnostics 6.12 or later
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1653.html
Restart Required: Yes
Instructions:
1. Download FactoryTalk Diagnostics 6.12 or later from Rockwell Automation. 2. Install the update following vendor instructions. 3. Restart affected systems.
🔧 Temporary Workarounds
Block TCP port 5241
windowsUse firewall rules to block unauthorized access to TCP port 5241.
netsh advfirewall firewall add rule name="Block FactoryTalk Diagnostics" dir=in action=block protocol=TCP localport=5241
Disable FactoryTalk Diagnostics service
windowsStop and disable the RsvcHost.exe service if not required.
sc stop "FactoryTalk Diagnostics"
sc config "FactoryTalk Diagnostics" start= disabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FactoryTalk Diagnostics systems from untrusted networks.
- Monitor for unauthorized access attempts to TCP port 5241 and investigate any suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check if FactoryTalk Diagnostics version is 6.11 or earlier and if RsvcHost.exe is listening on TCP port 5241.Check Version:
Check the version in Control Panel > Programs and Features or via the application interface.Verify Fix Applied:
Verify FactoryTalk Diagnostics version is 6.12 or later and test that malicious log entries no longer cause application crashes.📡 Detection & Monitoring
Log Indicators:
- Unusual entries in FactoryTalk Diagnostics event log with long field values
- Application crashes of FTDiagViewer.exe
Network Indicators:
- Unauthorized connections to TCP port 5241
- Unusual traffic patterns to FactoryTalk Diagnostics systems
SIEM Query:
source="FactoryTalk Diagnostics" AND (event_id="Application Error" OR message="*wcscpy_s*" OR message="*unhandled exception*")