PT-2018-5665 · Allen Bradley · Allen Bradley Micrologix 1400 Series B

Publicado 2018-04-05 · Atualizado 2022-04-19 · CVE-2017-14470

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Allen Bradley Micrologix 1400 Series B FRN versions 21.2 and before

Description: An access control issue exists in the data, program, and function file permissions functionality. This allows a specially crafted packet to perform read or write operations, potentially disclosing sensitive information, modifying settings, or altering ladder logic. An attacker can exploit this without authentication by sending specific packets. The issue is triggered when a float value is set to 0xffffffff, considered as NaN, and used in the PLC, resulting in a fault.

Recommendations: For Allen Bradley Micrologix 1400 Series B FRN versions 21.2 and before, consider restricting access to the device when it is in REMOTE, PROG, or RUN Keyswitch State to minimize the risk of exploitation. As a temporary workaround, avoid using float values set to 0xffffffff in the PLC until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2017-14470

Produtos afetados

Allen Bradley Micrologix 1400 Series B

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0443 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14470 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14470 · Nota de Segurança