CVE-2020-5801 Denial of service in Rockwell FactoryTalk Linx

What is CVE-2020-5801?

CVE-2020-5801 is a high-severity denial of service vulnerability in Rockwell FactoryTalk Linx, published on 29 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDManager::HandleRequest function in RnaDaSvr.dll, resulting in process termination. Observed in FactoryTalk Linx 6.11. All versions of FactoryTalk Linx are affected.

Weakness: CWE-755

Which versions are affected by CVE-2020-5801?

It affects 1 product.

Products include Rockwellautomation Factorytalk Linx.

How do I fix CVE-2020-5801?

No fix has been published for CVE-2020-5801 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-5801 being exploited?

There is no known exploitation of CVE-2020-5801 in the wild and no public exploit code.

Other vulnerabilities in Rockwell FactoryTalk Linx

• CVE-2020-27251 Memory corruption in FactoryTalk Linx Critical 9.8
• CVE-2020-12001 Path traversal in FactoryTalk Linx, RSLinx Classic, Connected Components Workbench, ControlFLASH Plus, FactoryTalk Asset Centre, FactoryTalk Linx CommDTM, Studio 5000 Launcher, Studio 5000 Logix Designer software Critical 9.8
• CVE-2025-9067 Rockwell Automation FactoryTalk® Linx Privilege Escalation Vulnerabilities High 8.5
• CVE-2025-9068 Rockwell Automation FactoryTalk® Linx Privilege Escalation Vulnerabilities High 8.5
• CVE-2025-7972 Rockwell Automation FactoryTalk® Linx Network Browser Security Bypass Vulnerability High 8.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4jvq-wc69-2rqj.