CVE-2023-3825 Rockwell Automation CVE debrief

Who should care

Industrial control system operators, OT engineers, plant administrators, and security teams responsible for Rockwell Automation KEPServerEX deployments should prioritize this advisory, especially where OPC UA connectivity is exposed on production or segmented control networks.

Technical summary

The advisory states that KEPServerEX uses OPC UA object types that can be nested into complex arrays, but it does not verify whether an incoming object is recursively defined. An attacker able to send a maliciously crafted OPC UA message could trigger uncontrolled resource consumption during decoding, leading to stack overflow and a device crash. The supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates a network-reachable availability impact without privileges or user interaction.

Defensive priority

High for availability and OT resilience. This is a network-reachable denial-of-service condition in industrial software, so patching should be prioritized in environments where KEPServerEX supports production control, monitoring, or data collection.

Recommended defensive actions

• Upgrade Rockwell Automation KEPServer to version 6.15 or higher.
• Confirm which systems run affected KEPServerEX versions 6.0 through 6.14.263 and track them as impacted assets.
• Restrict and segment OPC UA access to only required hosts and networks.
• Apply Rockwell Automation and CISA industrial control system security best practices where feasible.
• Use stakeholder-specific vulnerability categorization to prioritize remediation based on the local OT environment.

Evidence notes

CISA’s CSAF advisory ICSA-25-030-04 identifies Rockwell Automation KEPServerEX versions 6.0 to 6.14.263 as affected. The advisory describes a recursive-object handling flaw in OPC UA decoding that can cause uncontrolled resource consumption, stack overflow, and device crash. The remediated version listed in the advisory is KEPServer 6.15 or higher. No Known Exploited Vulnerabilities (KEV) listing was provided in the supplied data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.