PT-2018-5346 · Rockwell Automation · Allen Bradley Micrologix 1400 Series B

Publicado 2018-04-05 · Atualizado 2023-01-28 · CVE-2017-12093

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Allen Bradley Micrologix 1400 Series B Firmware versions 21.2 and before

Description The issue is related to an insufficient resource pool in the session communication functionality. It can be triggered by a specially crafted stream of packets, causing a flood of the session resource pool. This results in legitimate connections to the PLC being disconnected. An attacker can exploit this by sending unauthenticated packets.

Recommendations For Allen Bradley Micrologix 1400 Series B Firmware versions 21.2 and before, consider restricting access to the session communication functionality until a fix is available. As a temporary workaround, implement measures to limit the impact of unauthenticated packet floods on the session resource pool. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2017-12093

Produtos afetados

Allen Bradley Micrologix 1400 Series B

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0445 · Exploit
• https://osv.dev/vulnerability/CVE-2017-12093 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-12093 · Nota de Segurança