CVE-2020-27251: A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send…

PriorityP266critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

5.46%

91.7th percentile

A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send malicious port ranges, which could result in remote code execution.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
rockwellautomation	factorytalk_linx	<= 6.11	—
rockwellautomation	factorytalk_linx	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Detect malicious port range values sent remotely to FactoryTalk Linx (Version 6.11 and prior) — heap overflow triggered via crafted port ranges in network packets ↗
→No authentication required for exploitation — monitor for unauthenticated inbound connections to FactoryTalk Linx service ports from unexpected sources ↗
→No known public exploits exist as of advisory date — prioritize detection of anomalous/malformed packets targeting FactoryTalk Linx rather than signature-based exploit matching ↗

·Vulnerability affects FactoryTalk Linx Version 6.11 and prior; patched versions are 6.10/6.11 with Patch Answer ID 1126433 or upgrade to v6.20 — ensure detection rules are scoped to unpatched instances ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.