ID:4974 - Exploit for Uncaught Exception in FactoryTalk Linx - CVE-2020-5801

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an uncaught exception when processing OpenNamespace messages. The OpenNamespace message is sent to TCP port 4241 to obtain a session identifier. Subsequent requests require a valid session-id to interact with the service listening on that port. In the OpenNamespace message, the session-id field in the message header should be absent or empty. If a second OpenNamespace request is sent with a valid session-id in it, the CFTLDManager::HandleRequest function in RnaDaSvr.dll loaded in RSLinxNG.exe leads to unhandled exception, resulting in termination of RSLinxNG.exe.

A remote non-authenticated attacker can send a malformed request and crash the RSLinxNG.exe service.

Remediation