CVE-2020-13573: 
Rockwell Automation RSLinx Classic vulnerability analysis and mitigation

A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3. The vulnerability, tracked as CVE-2020-13573, was discovered by Alexander Perez-Palma of Cisco Talos and allows an attacker to cause a denial of service condition by sending specially crafted network requests (Talos Report, SecurityWeek).

The vulnerability occurs when sending a Register Session request followed by a Send Unit Data message where the Address Item Length is smaller than the data that follows. The issue stems from a lack of validation check comparing user input size against what the application can receive and process. When exploited, the resulting pointer points to unmapped memory and crashes when dereferenced. The vulnerability has been assigned a CVSS v3.0 base score of 7.5 (High) with vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H and is classified as CWE-823 (Use of Out-of-range Pointer Offset) (Talos Report).

When successfully exploited, the vulnerability can cause a denial of service condition in the RSLinx component. While this would not typically impact the operation of the PLC directly, it would prevent administrators from applying new configurations and changes to the PLC and lose visibility into the PLC's operation (SecurityWeek).

The vulnerability can be exploited by an unauthenticated remote attacker by sending a sequence of malicious packets to trigger the denial of service condition. The attack requires no user interaction and has low attack complexity (Talos Report).

According to Cisco Talos, the issue was resolved by Rockwell Automation in November 2020. The vendor acknowledged the issue was resolved on January 5, 2021 (Talos Report).