CVE-2021-38473
📋 TL;DR
This vulnerability allows attackers to trigger a stack overflow by manipulating function arguments in affected products, potentially leading to arbitrary code execution or denial of service. It affects industrial control systems and related software that use vulnerable code libraries. Organizations using these systems in critical infrastructure are particularly at risk.
💻 Affected Systems
- Rockwell Automation FactoryTalk Linx software
- Rockwell Automation RSLinx Classic
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, manipulation of industrial processes, or persistent backdoor installation.
Likely Case
Denial of service causing system crashes or instability in industrial control environments.
If Mitigated
Limited impact with proper network segmentation and exploit mitigations in place.
🎯 Exploit Status
No public exploit code available, but vulnerability is straightforward to exploit given the stack overflow nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FactoryTalk Linx v6.12 or later, RSLinx Classic v4.11.01 or later
Vendor Advisory: https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1131435
Restart Required: Yes
Instructions:
1. Download the updated software from Rockwell Automation's security advisory page. 2. Install the update following vendor instructions. 3. Restart affected systems to apply changes.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected systems from untrusted networks using firewalls and VLANs.
Disable Unnecessary Services
windowsTurn off FactoryTalk Linx or RSLinx Classic services if not required for operations.
sc stop "FactoryTalk Linx"
sc stop "RSLinx Classic"
🧯 If You Can't Patch
- Implement strict network access controls to limit communication to trusted hosts only.
- Deploy host-based intrusion prevention systems (HIPS) with stack overflow protection.
🔍 How to Verify
Check if Vulnerable:
Check installed version of FactoryTalk Linx or RSLinx Classic via Control Panel > Programs and Features.Check Version:
wmic product where name like "FactoryTalk Linx%" get versionVerify Fix Applied:
Verify version is FactoryTalk Linx v6.12+ or RSLinx Classic v4.11.01+ after patching.📡 Detection & Monitoring
Log Indicators:
- Application crashes in FactoryTalk Linx or RSLinx Classic logs
- Windows Event Log entries for application failures
Network Indicators:
- Unusual traffic patterns to FactoryTalk Linx ports (typically 44818, 2222)
- Malformed packets targeting industrial protocols
SIEM Query:
source="windows" AND (event_id=1000 OR event_id=1001) AND process_name="FactoryTalkLinx.exe"