PT-2018-1862 · Rockwell Automation · Rslinx Classic

Alessandro Di Pinto + 1 · Published 2018-09-20 · Updated 2019-10-09 · CVE-2018-14827

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation RSLinx Classic versions 4.00.01 and prior

Description The issue is related to an uncontrolled resource consumption vulnerability. A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP packets to "Port 44818", causing the software application to stop responding and crash, resulting in a denial of service. The user must restart the software to regain functionality.

Recommendations For Rockwell Automation RSLinx Classic versions 4.00.01 and prior, consider restricting access to "Port 44818" to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the affected port in the software configuration to prevent potential crashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2018-01464

CVE-2018-14827

Affected Products

Rslinx Classic

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-14827 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14827 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01464 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-263-02 · Note
• https://securitylab.ru/news/495668.php · Note
• https://tenable.com/security/research/tra-2018-26 · Note
• https://cxsecurity.com/cveshow/CVE-2018-3943 · Note
• https://threatpost.ru/rockwell-releases-new-patches-for-rslinx-classic/28368 · Note