Tenable Research Advisory: Rockwell Automation RSLinx Classic Lite RCE and DoS Vulnerability Discovered by Tenable
Tenable Research has discovered multiple memory corruption issues in Rockwell Automation RSLinx Classic Lite 4.00.01 that may allow for remote code execution or denial of service. Customers are encouraged to update their software.
|
What do you need to know? Rockwell Automation RSLinx Classic could allow for memory corruption and remote code execution or denial of service. What’s the attack vector? Common industrial protocol messages over port 44818 to the RSLINX.exe service. What’s the business impact? Memory corruption and remote code execution could lead to malicious takeover of an asset. What’s the solution? Apply the latest update from Rockwell Automation for RSLinx Classic. |
Background
While researching methods for remotely identifying Rockwell Automation RSLinx Classic, Tenable Research found multiple memory corruption issues in RSLinx Classic Lite 4.00.01 (CVE-2018-14829 and CVE-2018-14821), which may allow an unauthenticated remote attacker to achieve remote code execution (RCE) or denial of service (DoS).
Analysis
RSLinx Classic Lite (RSLINX.exe) implements EtherNet/IP, which encapsulates common industrial protocol (CIP) messages. Due to RSLINX.exe not checking various CIP length fields against the number of received network data bytes thoroughly, an unauthenticated remote attacker can exploit this via port 44818 to cause memory corruption issues.
Within the buffer overflow caused through this exploit, an attacker can then trigger arbitrary code execution.
Vendor response
Rockwell Automation has released software patches for RSLinx Classic versions V3.60, V3.74, V3.80, V3.81, V3.90 and V4.00.01.
Solution
According to Rockwell Automation’s advisory, customers are strongly encouraged to update their software. They have also recommended customers disable port 44818 in RSLinx Classic if it is not utilized during system operation. Customers should also follow other security best practices like limiting administrator privileges and blocking all traffic to EtherNet/IP or other CIP-based devices from external sources.
Identifying affected systems
Tenable has released the following plugin to detect these vulnerabilities.
|
Plugin ID |
Description |
|
Rockwell Automation RSLinx Classic <= 4.00.01 Multiple Vulnerabilities |
Get more information
Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.
Related Articles
Cybersecurity Snapshot: CISA Hands Down Cloud Security Directive, While Threat from North Korean IT Workers Gets the Spotlight
December 20, 2024Check out the new cloud security requirements for federal agencies. Plus, beware of North Korean government operatives posing as remote IT pros. Also, learn how water plants can protect their HMIs against cyberattacks. And get the latest on the U.S. cyber incident response framework; the CIS Benchmarks; and local and state governments’ cyber challenges.
Web App Scanning 101: What Security Pros Need to Know About CI/CD Pipelines
December 19, 2024Git, repositories and pipelines…oh my! We unpack standard practices in the web app development process and provide guidance on how to use Tenable Web Application Scanning to secure your code.
Cybersecurity Snapshot: Telecoms May Face Tougher Regulations After Salt Typhoon Hacks, as Study Finds Cyber Pros More Stressed at Work
December 13, 2024The FCC wants stronger cyber regulations for telecoms after cyber espionage breaches. Meanwhile, find out why cyber pros say work has become more difficult. Plus, check out tips to prevent AI-boosted financial fraud. And get the latest on vulnerability management, EU cyber challenges and CIS predictions for 2025.