PT-2018-5662 · Rockwell Automation · Allen Bradley Micrologix 1400 Series B

CVE-2017-14467 · Publicado 2018-04-05 · Atualizado 2022-12-14

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Allen Bradley Micrologix 1400 Series B versions 21.2 and before

Description: The issue allows for unauthorized access and modification of sensitive information due to improper access control in the data, program, and function file permissions functionality. An attacker can send specially crafted, unauthenticated packets to trigger the issue, resulting in the disclosure of sensitive information, modification of settings, or modification of ladder logic. This can be achieved by making live rung edits, allowing for the addition, deletion, or modification of existing ladder logic. Additionally, faults and CPU state modification can be triggered if specific ladder logic is used.

Recommendations: For Allen Bradley Micrologix 1400 Series B versions 21.2 and before, consider restricting access to the device to prevent unauthenticated packets from being sent, and limit live rung edits to authenticated users only. As a temporary workaround, consider disabling remote access until a patch is available.

Exploit

Correção

Identificadores relacionados

CVE-2017-14467

Produtos afetados

Allen Bradley Micrologix 1400 Series B

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0443 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14467 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14467 · Nota de Segurança