Tenable Research has discovered multiple memory corruption issues in Rockwell Automation RSLinx Classic Lite 4.00.01 that may allow for remote code execution or denial of service. Customers are encouraged to update their software.
What do you need to know? Rockwell Automation RSLinx Classic could allow for memory corruption and remote code execution or denial of service.
What’s the attack vector? Common industrial protocol messages over port 44818 to the RSLINX.exe service.
What’s the business impact? Memory corruption and remote code execution could lead to malicious takeover of an asset.
What’s the solution? Apply the latest update from Rockwell Automation for RSLinx Classic.
While researching methods for remotely identifying Rockwell Automation RSLinx Classic, Tenable Research found multiple memory corruption issues in RSLinx Classic Lite 4.00.01 (CVE-2018-14829 and CVE-2018-14821), which may allow an unauthenticated remote attacker to achieve remote code execution (RCE) or denial of service (DoS).
RSLinx Classic Lite (RSLINX.exe) implements EtherNet/IP, which encapsulates common industrial protocol (CIP) messages. Due to RSLINX.exe not checking various CIP length fields against the number of received network data bytes thoroughly, an unauthenticated remote attacker can exploit this via port 44818 to cause memory corruption issues.
Within the buffer overflow caused through this exploit, an attacker can then trigger arbitrary code execution.
Rockwell Automation has released software patches for RSLinx Classic versions V3.60, V3.74, V3.80, V3.81, V3.90 and V4.00.01.
According to Rockwell Automation’s advisory, customers are strongly encouraged to update their software. They have also recommended customers disable port 44818 in RSLinx Classic if it is not utilized during system operation. Customers should also follow other security best practices like limiting administrator privileges and blocking all traffic to EtherNet/IP or other CIP-based devices from external sources.
Identifying affected systems
Tenable has released the following plugin to detect these vulnerabilities.
Rockwell Automation RSLinx Classic <= 4.00.01 Multiple Vulnerabilities