Read the docs
TI-2013-02450 Aliases CVE-2013-2805GHSA-hc22-58vm-mg54

Out-of-bounds read in Rockwell RSLinx Enterprise Software

Priority LOW 39CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not handle input correctly and results in a logic error if it receives a datagram with an incorrect value in the “Record Data Size” field. By sending a datagram to the service over Port 4444/UDP with the “Record Data Size” field modified to an oversized value, an attacker could cause an out-of-bounds read access violation that leads to a service crash. The service can be recovered with a manual reboot. The patches and details pertaining to this vulnerability can be found at the following Rockwell Automation Security Advisory link (login is required): https://rockwellautomation.custhelp.com/app/answers/detail/a_id/537599

Why it matters now

EPSS 0.03855 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
RockwellRSLinx Enterprise SoftwareCPR9; CPR9-SR1; CPR9-SR2; CPR9-SR3; CPR9-SR4; CPR9-SR5; CPR9-SR5.1; CPR9-SR6—No fix listedCNA
  • RSLinx Enterprise Software VendorRockwell Affected CPR9; CPR9-SR1; CPR9-SR2; CPR9-SR3; CPR9-SR4; CPR9-SR5; CPR9-SR5.1; CPR9-SR6 Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.10.00:*:*:*:*:*:*:*5.10.00VulnerableRockwell
cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.10.01:*:*:*:*:*:*:*5.10.01VulnerableRockwell
cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.20.00:*:*:*:*:*:*:*5.20.00VulnerableRockwell
cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.21.00:*:*:*:*:*:*:*5.21.00VulnerableRockwell
cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.30.00:*:*:*:*:*:*:*5.30.00VulnerableRockwell
cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.40.00:*:*:*:*:*:*:*5.40.00VulnerableRockwell
cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.50.00:*:*:*:*:*:*:*5.50.00VulnerableRockwell
cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.51.00:*:*:*:*:*:*:*5.51.00VulnerableRockwell
cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.60.00:*:*:*:*:*:*:*5.60.00VulnerableRockwell
  • cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.10.00:*:*:*:*:*:*:* Versions 5.10.00 Vulnerable ·Rockwell
  • cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.10.01:*:*:*:*:*:*:* Versions 5.10.01 Vulnerable ·Rockwell
  • cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.20.00:*:*:*:*:*:*:* Versions 5.20.00 Vulnerable ·Rockwell
  • cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.21.00:*:*:*:*:*:*:* Versions 5.21.00 Vulnerable ·Rockwell
  • cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.30.00:*:*:*:*:*:*:* Versions 5.30.00 Vulnerable ·Rockwell
  • cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.40.00:*:*:*:*:*:*:* Versions 5.40.00 Vulnerable ·Rockwell
  • cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.50.00:*:*:*:*:*:*:* Versions 5.50.00 Vulnerable ·Rockwell
  • cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.51.00:*:*:*:*:*:*:* Versions 5.51.00 Vulnerable ·Rockwell
  • cpe:2.3:a:rockwellautomation:rslinx_enterprise:5.60.00:*:*:*:*:*:*:* Versions 5.60.00 Vulnerable ·Rockwell

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-2805
  2. 2026-10-03 Alias added: GHSA-hc22-58vm-mg54
  3. 2026-10-16 EPSS moved to the 90th–95th percentile

References

Advisory 1

  • TI-2012-04021 Buffer overflow in LogReceiver.exe in Rockwell Automation RSLinx Enterprise CPR9… CVSS 2.0HIGH 10.0
  • TI-2013-02452 Integer overflow in Rockwell RSLinx Enterprise Software CVSS 3.0HIGH 7.5
  • TI-2013-02451 Integer overflow in Rockwell RSLinx Enterprise Software CVSS 3.0HIGH 7.5
  • TI-2020-09693 SQL injection in EDS Subsystem, FactoryTalk Linx software , RSLinx Classic, RSNetWorx… CVSS 3.1HIGH 8.2
  • TI-2012-04002 LogReceiver.exe in Rockwell Automation RSLinx Enterprise CPR9, CPR9-SR1, CPR9-SR2… CVSS 2.0HIGH 7.1
  • TI-2020-09697 Memory corruption in EDS Subsystem, FactoryTalk Linx software , RSLinx Classic, RSNetWorx… CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences