CVE-2020-13573
📋 TL;DR
A denial-of-service vulnerability in Rockwell Automation RSLinx Classic's Ethernet/IP server allows attackers to crash the service by sending specially crafted network packets. This affects industrial control systems using RSLinx Classic for communication with Rockwell PLCs and other devices. The vulnerability requires network access to the vulnerable service.
💻 Affected Systems
- Rockwell Automation RSLinx Classic
📦 What is this software?
Rslinx by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of industrial operations by crashing RSLinx Classic, preventing communication with PLCs and causing production downtime.
Likely Case
Service disruption requiring manual restart of RSLinx Classic, causing temporary production interruptions.
If Mitigated
Minimal impact if service is isolated and monitored with automatic restart capabilities.
🎯 Exploit Status
The Talos report includes technical details that could be used to create exploits. The vulnerability requires sending specific packet sequences to the Ethernet/IP port.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 4.11.00 or later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1127683
Restart Required: Yes
Instructions:
1. Download RSLinx Classic 4.11.00 or later from Rockwell Automation website. 2. Backup current configuration. 3. Install the updated version. 4. Restart the system to apply changes.
🔧 Temporary Workarounds
Network Segmentation
allIsolate RSLinx Classic systems from untrusted networks using firewalls or network segmentation.
Service Monitoring and Auto-restart
windowsConfigure monitoring to detect RSLinx Classic crashes and automatically restart the service.
sc failure RSLinxClassic reset= 86400 actions= restart/60000/restart/120000/restart/180000
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to RSLinx Classic from trusted sources only.
- Deploy network intrusion detection systems to monitor for malicious Ethernet/IP packets and alert on suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check RSLinx Classic version via Help > About in the application or check installed programs in Windows.Check Version:
wmic product where "name like 'RSLinx%'" get versionVerify Fix Applied:
Verify version is 4.11.00 or later and test Ethernet/IP connectivity with legitimate clients.📡 Detection & Monitoring
Log Indicators:
- RSLinx Classic service crash events in Windows Event Log
- Unexpected service restarts
Network Indicators:
- Multiple malformed Ethernet/IP packets to port 44818
- Unusual traffic patterns to RSLinx Classic systems
SIEM Query:
source="windows" AND (event_id=7031 OR event_id=7034) AND service_name="RSLinxClassic"