Detections
Analytics
Rockwell Automation RSLinx Classic <= 4.00.01 Multiple Vulnerabilities (ICSA-18-263-02)
critical Nessus Network Monitor Plugin ID 720266
Synopsis
Rockwell Automation RSLinx Classic is affected by multiple vulnerabilities.Description
A stack-based buffer oveflow vulnerability may allow a remote threat actor to intentionally send a malformed CIP packet to Port 44818, causing the software application to stop responding and crash. This vulnerability also has the potential to exploit a buffer overflow condition, which may allow the threat actor to remotely execute arbitrary code (CVE-2018-14829).- A heap-based buffer overflow vulnerability may allow a remote, unauthenticated threat actor to intentionally send a malformed CIP packet to Port 44818, causing the RSLinx Classic application to terminate. The user will need to manually restart the software to regain functionality. (CVE-2018-14821)
- A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP packets to Port 44818, causing the software application to stop responding and crash. The user must restart the software to regain functionality. (CVE-2018-14827)
Solution
Perform vendor recommended mitigations and apply available vendor upgrades.See Also
Plugin Details
Severity: Critical
ID: 720266
Family: SCADA
Published: 7/15/2019
Updated: 9/30/2019
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Patch Publication Date: 9/20/2018
Vulnerability Publication Date: 9/20/2018