Sign-up

ID

VAR-202012-1434


CVE

CVE-2020-5807


TITLE

FactoryTalk Diagnostics  Vulnerability in handling exceptional conditions in

Trust: 0.8

sources: JVNDB: JVNDB-2020-014972

DESCRIPTION

An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics event log. The attacker can specify long fields in the log entry, which can cause an unhandled exception in wcscpy_s() if a local user opens FactoryTalk Diagnostics Viewer (FTDiagViewer.exe) to view the log entry. Observed in FactoryTalk Diagnostics 6.11. All versions of FactoryTalk Diagnostics are affected. FactoryTalk Diagnostics Is vulnerable to handling exceptional conditions.Denial of service (DoS) It may be put into a state. Rockwell Automation FactoryTalk Diagnostics is a software for diagnosing equipment status in industrial environments developed by Rockwell Automation in the United States. This software belongs to a subsystem in the FactoryTalk industrial framework

Trust: 1.71

sources: NVD: CVE-2020-5807 // JVNDB: JVNDB-2020-014972 // VULHUB: VHN-183932

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:factorytalk diagnosticsscope:lteversion:6.11

Trust: 1.0

vendor:rockwell automationmodel:factorytalk diagnostics viewerscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-014972 // NVD: CVE-2020-5807

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-5807
value: HIGH

Trust: 1.0

NVD: CVE-2020-5807
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202012-1770
value: HIGH

Trust: 0.6

VULHUB: VHN-183932
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-5807
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-183932
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-5807
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2020-5807
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-183932 // JVNDB: JVNDB-2020-014972 // CNNVD: CNNVD-202012-1770 // NVD: CVE-2020-5807

PROBLEMTYPE DATA

problemtype:CWE-755

Trust: 1.1

problemtype:Improper handling in exceptional conditions (CWE-755) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-183932 // JVNDB: JVNDB-2020-014972 // NVD: CVE-2020-5807

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202012-1770

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202012-1770

PATCH

title:Top Pageurl:https://www.rockwellautomation.com/

Trust: 0.8

title:FactoryTalk Diagnostics Repair measures for all security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=138275

Trust: 0.6

sources: JVNDB: JVNDB-2020-014972 // CNNVD: CNNVD-202012-1770

EXTERNAL IDS

db:TENABLEid:TRA-2020-71

Trust: 2.5

db:NVDid:CVE-2020-5807

Trust: 2.5

db:JVNid:JVNVU98988953

Trust: 0.8

db:JVNDBid:JVNDB-2020-014972

Trust: 0.8

db:CNNVDid:CNNVD-202012-1770

Trust: 0.7

db:AUSCERTid:ESB-2021.0327

Trust: 0.6

db:ICS CERTid:ICSA-21-028-01

Trust: 0.6

db:VULHUBid:VHN-183932

Trust: 0.1

sources: VULHUB: VHN-183932 // JVNDB: JVNDB-2020-014972 // CNNVD: CNNVD-202012-1770 // NVD: CVE-2020-5807

REFERENCES

url:https://www.tenable.com/security/research/tra-2020-71

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2020-5807

Trust: 1.4

url:https://jvn.jp/vu/jvnvu98988953/

Trust: 0.8

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-028-01

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.0327/

Trust: 0.6

sources: VULHUB: VHN-183932 // JVNDB: JVNDB-2020-014972 // CNNVD: CNNVD-202012-1770 // NVD: CVE-2020-5807

SOURCES

db:VULHUBid:VHN-183932
db:JVNDBid:JVNDB-2020-014972
db:CNNVDid:CNNVD-202012-1770
db:NVDid:CVE-2020-5807

LAST UPDATE DATE

2024-11-23T21:35:01.215000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-183932date:2020-12-30T00:00:00
db:JVNDBid:JVNDB-2020-014972date:2021-09-06T08:38:00
db:CNNVDid:CNNVD-202012-1770date:2021-02-01T00:00:00
db:NVDid:CVE-2020-5807date:2024-11-21T05:34:37.977

SOURCES RELEASE DATE

db:VULHUBid:VHN-183932date:2020-12-29T00:00:00
db:JVNDBid:JVNDB-2020-014972date:2021-09-06T00:00:00
db:CNNVDid:CNNVD-202012-1770date:2020-12-29T00:00:00
db:NVDid:CVE-2020-5807date:2020-12-29T16:15:14.933