CVE-2016-5814
highpriority · track · 36EPSS 0.047 · 92 %ileEUUSEPSS · scored 2026-10-27
Buffer overflow in Rockwell Automation RSLogix Micro Starter Lite, RSLogix Micro Developer, RSLogix 500 Starter Edition, RSLogix 500 Standard Edition, and RSLogix 500 Professional Edition allows remote attackers to execute arbitrary code via a crafted RSS project file.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationRSLogix 500 Professional Editioncisa_csaf_ot
Users using affected versions of RSLogix 500 and RSLogix Micro are encouraged to update to Version 11.00.00 that addresses associated risk and includes added improvements to further harden the software and enhance its resilience against similar malicious attacks. Version 11.00.00 can be found on Rockwell Automation’s web site at the following URL with a valid account: (http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112)
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112 - MitigationRSLogix 500 Standard Editioncisa_csaf_ot
Users using affected versions of RSLogix 500 and RSLogix Micro are encouraged to update to Version 11.00.00 that addresses associated risk and includes added improvements to further harden the software and enhance its resilience against similar malicious attacks. Version 11.00.00 can be found on Rockwell Automation’s web site at the following URL with a valid account: (http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112)
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112 - MitigationRSLogix 500 Starter Editioncisa_csaf_ot
Users using affected versions of RSLogix 500 and RSLogix Micro are encouraged to update to Version 11.00.00 that addresses associated risk and includes added improvements to further harden the software and enhance its resilience against similar malicious attacks. Version 11.00.00 can be found on Rockwell Automation’s web site at the following URL with a valid account: (http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112)
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112 - MitigationRSLogix Micro Developercisa_csaf_ot
Users using affected versions of RSLogix 500 and RSLogix Micro are encouraged to update to Version 11.00.00 that addresses associated risk and includes added improvements to further harden the software and enhance its resilience against similar malicious attacks. Version 11.00.00 can be found on Rockwell Automation’s web site at the following URL with a valid account: (http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112)
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112 - MitigationRSLogix Micro Starter Litecisa_csaf_ot
Users using affected versions of RSLogix 500 and RSLogix Micro are encouraged to update to Version 11.00.00 that addresses associated risk and includes added improvements to further harden the software and enhance its resilience against similar malicious attacks. Version 11.00.00 can be found on Rockwell Automation’s web site at the following URL with a valid account: (http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112)
http://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=rslogix%20500&crumb=112
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (16)
Products and version ranges known to be affected.
- rockwellautomation rslogix 500 professional editionall versionsnvdUScpe:2.3:a:rockwellautomation:rslogix_500_professional_edition:*:*:*:*:*:*:*:*
- rockwellautomation rslogix 500 standard editionall versionsnvdUScpe:2.3:a:rockwellautomation:rslogix_500_standard_edition:*:*:*:*:*:*:*:*
- rockwellautomation rslogix 500 starter editionall versionsnvdUScpe:2.3:a:rockwellautomation:rslogix_500_starter_edition:*:*:*:*:*:*:*:*
- rockwellautomation rslogix micro developerall versionsnvdUScpe:2.3:a:rockwellautomation:rslogix_micro_developer:*:*:*:*:*:*:*:*
- rockwellautomation rslogix micro starter liteall versionsnvdUScpe:2.3:a:rockwellautomation:rslogix_micro_starter_lite:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSA-16-224-02ARockwell Automation RSLogix 500 and RSLogix Micro File Parser Buffer Overflow Vulnerability (Update A)2016-05-15icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (6)
External citations — patches, advisories, analysis.
- https://ics-cert.us-cert.gov/advisories/ICSA-16-224-02cnnvd
- https://rockwellautomation.co/Patchcnnvd
- http://www.securityfocus.com/bid/92983enisa_euvd
- https://ics-cert.us-cert.gov/advisories/ICSA-16-224-02enisa_euvd
- http://www.securityfocus.com/bid/92983nvd
- https://ics-cert.us-cert.gov/advisories/ICSA-16-224-02MitigationPatchThird Party AdvisoryUS Government Resourcenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan