Logic Error in Rockwell Automation RSLinx Enterprise Software Due to Input Handling Flaw
CVE-2013-2806

7.5HIGH

Key Information:

Vendor

Rockwell Automation
Status
Rslinx Enterprise Software
Vendor
CVE Published:
26 March 2019

What is CVE-2013-2806?

The RSLinx Enterprise Software from Rockwell Automation contains a vulnerability due to improper input handling in its LogReceiver.exe component. An attacker can exploit this vulnerability by sending a specially crafted datagram to the service over Port 4444/UDP. This manipulated datagram features an oversized 'Record Data Size', leading the software to miscalculate the 'Total Record Size' and the 'End of Current Record'. Such errors can cause access violations and eventually result in a service crash, which requires a manual reboot to recover the service. Users are encouraged to review the Rockwell Automation security advisory for detailed patch information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

RSLinx Enterprise Software CPR9

RSLinx Enterprise Software CPR9-SR1

RSLinx Enterprise Software CPR9-SR2

References

https://ics-cert.us-cert.gov/advisories/ICSA-13-095-02
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.