Skip to main content
No exploitation reported

CVE-2018-14829

No exploitation reported by the sources we read.

  • Published2018-09-20
  • WeaknessCWE-119 · CWE-121

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote threat actor to intentionally send a malformed CIP packet to Port 44818, causing the software application to stop responding and crash. This vulnerability also has the potential to exploit a buffer overflow condition, which may allow the threat actor to remotely execute arbitrary code.

Timeline

dates in UTC
  1. 2018-09-2019:29CVE publishedNVD

Observed activity

isMalicious corpus · updated 2026-11-03 21:37 UTC
Indicators tagged with this CVE, per day0 indicators over 7 days
Block these indicators
  • Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2018-14829?format=txt
  • CSV export: https://api.ismalicious.com/edl/cve/CVE-2018-14829?format=csv
  • TAXII collection of exploited CVEs
  • The EDL and CSV take an API key on the Pro plan.

Versions per branch

NVD
Rockwellautomation rslinx
BranchAffectedFixed in
4.0≤ 4.00.01no fix published

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • ICSA-18-263-02 CISA1 known affected

    Rockwell Automation RSLinx Classic

    RSLinx Classic: Versions 4.00.01 and prior

Full record on NVD

Fix

  1. Mitigation from the vendor CISA ICSA-18-263-02 · 1 productRockwell Automation has released a new version of the software that can found at Rockwell Automation knowledgebase article KB 1075712
  2. Mitigation from the vendor CISA ICSA-18-263-02 · 1 productRockwell Automation also reports that users can disable Port 44818 if it is not utilized during system operation. For more details on how to disable the port and for Rockwell Automation's general security guidelines, please visit knowledgebase article KB 1075747 (login is required)
  3. Mitigation from the vendor CISA ICSA-18-263-02 · 1 productPlease see Rockwell Automation's industrial security advisory at the following location on their website for further details (login is required)

Detection

Nuclei template
none so far
ProjectDiscovery
Exploit-DB
no entry
Exploit-DB
Proof-of-concept repositories
none listed
PoC-in-GitHub
Metasploit modules
none listed
Metasploit Framework

Sources

  • NVDCVSS 3.09.8read 2026-10-23
  • NVDCVSS 2.07.5read 2026-10-23
  • CNAweakness (CWE)CWE-121known since 2026-10-23
  • NVDweakness (CWE)CWE-119read 2026-10-23
  • FIRST EPSSEPSS score16.1 %read 2026-11-03
  • GitHub Advisoriesadvisory—

Identifiers

Technical details

CVSS v3 Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
2018-09-20
Last Modified
2026-06-17
NVD status
Modified
GitHub Advisory
GHSA-264m-mv26-f7f5

Frequently asked questions

What is CVE-2018-14829?

Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote threat actor to intentionally send a malformed CIP packet to Port 44818, causing the software application to stop responding and crash. This vulnerability also has the potential to exploit a buffer overflow condition, which may allow the threat actor to remotely execute arbitrary code.

Is CVE-2018-14829 actively exploited?

Active exploitation of CVE-2018-14829 has not been confirmed. Its EPSS score was 16.1% on 2026-11-03, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2018-14829?

CVE-2018-14829 has a CVSS v3 base score of 9.8 (CRITICAL severity), with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Running Rockwell Automation RSLinx? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this productCISA KEV additions, November 2026Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record