PT-2017-17983 · Rockwell Automation · Micrologix 1400+1

David Formby + 1 · Publicado 2017-06-30 · Atualizado 2019-10-09 · CVE-2017-7902

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers versions 16.00 and prior Rockwell Automation Allen-Bradley MicroLogix 1400 programmable logic controllers versions 16.00 and prior

Description A "Reusing a Nonce, Key Pair in Encryption" issue was discovered, where the affected product reuses nonces. This may allow an attacker to capture and replay a valid request until the nonce is changed.

Recommendations For Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers versions 16.00 and prior, update to a version later than 16.00 to resolve the issue. For Rockwell Automation Allen-Bradley MicroLogix 1400 programmable logic controllers versions 16.00 and prior, update to a version later than 16.00 to resolve the issue.

Correção

Use of Insufficiently Random Values

Enumeração de Fraquezas

CWE-323

CWE-330

Identificadores relacionados

CVE-2017-7902

Produtos afetados

Micrologix 1100

Micrologix 1400

Referências · 4

• https://ics-cert.us-cert.gov/advisories/ICSA-17-115-04 · Correção
• https://osv.dev/vulnerability/CVE-2017-7902 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7902 · Nota de Segurança
• http://securitytracker.com/id/1038546 · Nota