PT-2020-19315 · Microsoft+1 · .Net Remoting+1

Published 1999-01-01 · Updated 2020-03-27 · CVE-2020-6967

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation FactoryTalk Diagnostics software (affected versions not specified)

Description The issue concerns the exposure of a .NET Remoting endpoint via RNADiagnosticsSrv.exe at TCP/8082, which can insecurely deserialize untrusted data. This allows for potential remote code execution.

Recommendations As a temporary workaround, consider restricting access to the .NET Remoting endpoint at TCP/8082 to minimize the risk of exploitation. Avoid sending untrusted data to the RNADiagnosticsSrv.exe service until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2020-6967

DOTNETREMOTINGCHECK

ZDI-20-261

Affected Products

.Net Remoting

Factorytalk Diagnostics

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-6967 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-261 · Security Note
• https://us-cert.gov/ics/advisories/icsa-20-051-02 · Note
• https://t.me/cvenotify/2047 · Telegram Post