PT-2018-2759 · Rockwell Automation · Micrologix 1400+1

David Noren · Publicado 2018-12-07 · Atualizado 2022-05-02 · CVE-2018-17924

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules (affected versions not specified)

Description The issue is related to a lack of authentication for a critical function in the MicroLogix 1400 and 1756 ControlLogix software. An unauthenticated, remote threat actor could send a CIP connection request to an affected device and, upon successful connection, send a new IP configuration to the affected device, even if the controller is set to Hard RUN mode. This can cause a loss of communication between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address. The exploitation of this issue can allow a remote attacker to cause a denial of service by connecting via the CIP protocol and sending an IP configuration to the vulnerable device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

BDU:2019-01739

CVE-2018-17924

Produtos afetados

1756 Controllogix

Micrologix 1400

Referências · 6

• https://bdu.fstec.ru/vul/2019-01739 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17924 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17924 · Nota de Segurança
• http://securityfocus.com/bid/106132 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-18-310-02 · Nota
• https://securitylab.ru/vulnerability/496887.php · Nota