PT-2017-17982 · Rockwell Automation · Micrologix 1400+1

CVE-2017-7901 · Publicado 2017-06-30 · Atualizado 2024-10-21

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers versions 16.00 and prior Rockwell Automation Allen-Bradley MicroLogix 1400 programmable logic controllers versions 16.00 and prior

Description A Predictable Value Range from Previous Values issue was discovered, where insufficiently random TCP initial sequence numbers are generated. This may allow an attacker to predict the numbers from previous values, potentially enabling them to spoof or disrupt TCP connections and resulting in a denial of service for the target device.

Recommendations For Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers versions 16.00 and prior, update to a version later than 16.00 to resolve the issue. For Rockwell Automation Allen-Bradley MicroLogix 1400 programmable logic controllers versions 16.00 and prior, update to a version later than 16.00 to resolve the issue.

Correção

DoS

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-343

CWE-330

Identificadores relacionados

CVE-2017-7901

Produtos afetados

Micrologix 1100

Micrologix 1400

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-7901 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04 · Correção
• http://securitytracker.com/id/1038546 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7901 · Nota de Segurança
• https://twitter.com/jmcmurry/status/1848502612649468181 · Publicação no Twitter