PT-2017-17981 · Rockwell Automation · Micrologix 1400+1

David Formby + 2 · Publicado 2017-06-30 · Atualizado 2019-10-03 · CVE-2017-7898

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers versions 16.00 and prior Rockwell Automation Allen-Bradley MicroLogix 1400 programmable logic controllers versions 16.00 and prior

Description An issue with improper restriction of excessive authentication attempts was found, allowing for repeated entry of incorrect passwords without penalties.

Recommendations For Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers versions 16.00 and prior, consider implementing additional authentication measures to restrict excessive login attempts until a patch is available. For Rockwell Automation Allen-Bradley MicroLogix 1400 programmable logic controllers versions 16.00 and prior, consider implementing additional authentication measures to restrict excessive login attempts until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2017-7898

Produtos afetados

Micrologix 1100

Micrologix 1400

Referências · 4

• https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04 · Correção
• http://securitytracker.com/id/1038546 · Nota
• https://osv.dev/vulnerability/CVE-2017-7898 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7898 · Nota de Segurança