PT-2017-10073 · Rockwell Automation · Logix5000

Publicado 2017-02-13 · Atualizado 2022-02-03 · CVE-2016-9343

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation Logix5000 Programmable Automation Controller versions 16.00 through 21.00

Description An issue allows an attacker to potentially execute code on the controller or initiate a denial of service by sending a malformed common industrial protocol (CIP) packet, which can overflow a stack-based buffer.

Recommendations For versions 16.00 through 21.00, consider restricting access to the CIP protocol until a fix is available to prevent potential exploitation.

Correção

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

CVE-2016-9343

Produtos afetados

Logix5000

Referências · 4

• http://securityfocus.com/bid/95304 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-16-343-05 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9343 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9343 · Aviso do Fabricante