Rockwell RSLinx <4.50.00 RCE via CVE-2020-13573 — Patch Now

Critical Vulnerability in Rockwell RSLinx Classic Exposes ICS to RCE and DoS

Rockwell Automation has identified and remediated a critical stack-based buffer overflow vulnerability, identified as CVE-2020-13573, affecting RSLinx Classic software versions up to and including 4.50.00. Successful exploitation of this vulnerability can lead to a complete denial of service (DoS), rendering the application unresponsive, and critically, may also allow an attacker to achieve RCE (Remote Code Execution). This poses a significant threat to industrial control system (ICS) environments, particularly within Critical Manufacturing, Energy, Food and Agriculture, and Water and Wastewater sectors globally. Given the widespread deployment of RSLinx Classic for communication between Rockwell Automation software and hardware, this vulnerability warrants immediate attention from security professionals managing such infrastructure, according to a recent CISA advisory.

Technical Analysis of CVE-2020-13573

The vulnerability, described as a stack-based buffer overflow and an Out-of-bounds Read (CWE-125), exists in Rockwell Automation RSLinx Classic versions 4.50.00 and earlier. This flaw could be triggered by an unauthenticated attacker sending specially crafted network packets to a vulnerable RSLinx Classic installation. The vulnerability has a CVSS v3.1 base score of 7.5, categorized as HIGH severity, with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The ‘Availability High’ metric signifies the severe impact on system uptime, resulting in a denial of service where the application becomes unresponsive and cannot self-recover. More concerning is the potential for an attacker to leverage this buffer overflow to remotely execute arbitrary code, which could lead to unauthorized control over industrial processes, data exfiltration, or further Lateral Movement within the operational technology (OT) network.

While CISA reports no known public exploitation of this specific vulnerability at the time of the advisory, the presence of RCE capability means that any successful exploitation could have catastrophic consequences in an ICS environment. Organizations must understand the full implications of a Rockwell RSLinx Classic version 4.50.00 RCE vulnerability and prioritize remediation to prevent potential operational disruptions or safety hazards.

Mitigating Rockwell RSLinx Classic CVE-2020-13573 Buffer Overflow

Rockwell Automation recommends specific actions to address this vulnerability. The primary recommendation for mitigation for CVE-2020-13573 buffer overflow is to upgrade all affected installations to RSLinx Classic version 4.60.00 or later. For those unable to immediately upgrade, Rockwell Automation suggests applying an available patch (BF31213) specific to their current version or implementing recommended security best practices. Further details are available on Rockwell Automation’s trust center.

Beyond vendor-specific patches, CISA emphasizes the importance of robust cybersecurity practices for ICS environments:

• Network Segmentation: Minimize network exposure for all control system devices and systems by ensuring they are not directly accessible from the internet. Isolate control system networks and remote devices behind firewalls, segmenting them from enterprise or business networks.
• Secure Remote Access: If remote access is required, implement more secure methods such as Virtual Private Networks (VPNs). It is crucial to ensure VPNs are regularly updated and properly configured, acknowledging that a VPN’s security is only as strong as the devices connected to it.
• Risk Assessment: Conduct a thorough impact analysis and risk assessment before deploying any defensive measures to understand potential disruptions.
• Proactive Defense: Implement recommended cybersecurity strategies for proactive defense of ICS assets, including Defense-in-Depth strategies. CISA provides additional guidance on their ICS webpage regarding cyber defense best practices.
• Social Engineering Awareness: Educate users on the risks of Phishing and social engineering attacks. Advise against clicking suspicious web links or opening attachments in unsolicited email messages to prevent initial compromise vectors.

Organizations committed to securing Rockwell ICS networks should also continuously monitor their environments. While no public exploits have been reported, vigilance remains key. Any suspected malicious activity should follow established internal procedures and be reported to CISA for broader threat intelligence correlation and tracking.