Sign-up

ID

VAR-202003-1592


CVE

CVE-2020-6967


TITLE

FactoryTalk Services Platform Unreliable data deserialization vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-003391

DESCRIPTION

In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCPtcp/8082, which can insecurely deserialize untrusted data. FactoryTalk Services Platform Exists in an unreliable data deserialization vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Rockwell Automation is a provider of industrial automation, control and information technology solutions

Trust: 2.43

sources: NVD: CVE-2020-6967 // JVNDB: JVNDB-2020-003391 // CNVD: CNVD-2020-14327 // IVD: cdeca353-d295-45c9-9c38-4cce7c22546f // VULHUB: VHN-185092

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: cdeca353-d295-45c9-9c38-4cce7c22546f // CNVD: CNVD-2020-14327

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:factorytalk services platformscope:eqversion: -

Trust: 1.0

vendor:rockwell automationmodel:factorytalk services platformscope: - version: -

Trust: 0.8

vendor:rockwellmodel:automation factorytalk diagnosticsscope: - version: -

Trust: 0.6

vendor:factorytalk services platformmodel: - scope:eqversion: -

Trust: 0.2

sources: IVD: cdeca353-d295-45c9-9c38-4cce7c22546f // CNVD: CNVD-2020-14327 // JVNDB: JVNDB-2020-003391 // NVD: CVE-2020-6967

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-6967
value: CRITICAL

Trust: 1.0

NVD: JVNDB-2020-003391
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2020-14327
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202002-1148
value: CRITICAL

Trust: 0.6

IVD: cdeca353-d295-45c9-9c38-4cce7c22546f
value: HIGH

Trust: 0.2

VULHUB: VHN-185092
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2020-6967
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2020-003391
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2020-14327
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: cdeca353-d295-45c9-9c38-4cce7c22546f
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-185092
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-6967
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: JVNDB-2020-003391
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: cdeca353-d295-45c9-9c38-4cce7c22546f // CNVD: CNVD-2020-14327 // VULHUB: VHN-185092 // JVNDB: JVNDB-2020-003391 // CNNVD: CNNVD-202002-1148 // NVD: CVE-2020-6967

PROBLEMTYPE DATA

problemtype:CWE-502

Trust: 1.9

sources: VULHUB: VHN-185092 // JVNDB: JVNDB-2020-003391 // NVD: CVE-2020-6967

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202002-1148

TYPE

Code problem

Trust: 0.8

sources: IVD: cdeca353-d295-45c9-9c38-4cce7c22546f // CNNVD: CNNVD-202002-1148

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2020-003391

PATCH
title:Top Pageurl:https://ab.rockwellautomation.com/lang-selection.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2020-003391

EXTERNAL IDS
db:NVDid:CVE-2020-6967
Trust: 3.3
db:ICS CERTid:ICSA-20-051-02
Trust: 3.1
db:CNNVDid:CNNVD-202002-1148
Trust: 0.9
db:CNVDid:CNVD-2020-14327
Trust: 0.8
db:JVNDBid:JVNDB-2020-003391
Trust: 0.8
db:AUSCERTid:ESB-2023.2947
Trust: 0.6
db:AUSCERTid:ESB-2020.0646
Trust: 0.6
db:IVDid:CDECA353-D295-45C9-9C38-4CCE7C22546F
Trust: 0.2
db:VULHUBid:VHN-185092
Trust: 0.1
sources:
            
            
            IVD: cdeca353-d295-45c9-9c38-4cce7c22546f // 
            
            
            
            CNVD: CNVD-2020-14327 // 
            
            
            
            VULHUB: VHN-185092 // 
            
            
            
            JVNDB: JVNDB-2020-003391 // 
            
            
            
            CNNVD: CNNVD-202002-1148 // 
            
            
            
            NVD: CVE-2020-6967

REFERENCES
url:https://www.us-cert.gov/ics/advisories/icsa-20-051-02
Trust: 3.1
url:https://nvd.nist.gov/vuln/detail/cve-2020-6967
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-6967
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2023.2947
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.0646/
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-14327 // 
            
            
            
            VULHUB: VHN-185092 // 
            
            
            
            JVNDB: JVNDB-2020-003391 // 
            
            
            
            CNNVD: CNNVD-202002-1148 // 
            
            
            
            NVD: CVE-2020-6967

SOURCES
db:IVDid:cdeca353-d295-45c9-9c38-4cce7c22546f
db:CNVDid:CNVD-2020-14327
db:VULHUBid:VHN-185092
db:JVNDBid:JVNDB-2020-003391
db:CNNVDid:CNNVD-202002-1148
db:NVDid:CVE-2020-6967

LAST UPDATE DATE
2024-11-23T23:04:26.834000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-14327date:2020-02-28T00:00:00
db:VULHUBid:VHN-185092date:2020-03-27T00:00:00
db:JVNDBid:JVNDB-2020-003391date:2020-04-15T00:00:00
db:CNNVDid:CNNVD-202002-1148date:2023-05-22T00:00:00
db:NVDid:CVE-2020-6967date:2024-11-21T05:36:24.250

SOURCES RELEASE DATE
db:IVDid:cdeca353-d295-45c9-9c38-4cce7c22546fdate:2020-02-25T00:00:00
db:CNVDid:CNVD-2020-14327date:2020-02-28T00:00:00
db:VULHUBid:VHN-185092date:2020-03-23T00:00:00
db:JVNDBid:JVNDB-2020-003391date:2020-04-15T00:00:00
db:CNNVDid:CNNVD-202002-1148date:2020-02-25T00:00:00
db:NVDid:CVE-2020-6967date:2020-03-23T21:15:12.207