PT-2018-5667 · Allen Bradley · Allen Bradley Micrologix 1400 Series B

Publicado 2018-04-05 · Atualizado 2022-04-19 · CVE-2017-14472

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Allen Bradley Micrologix 1400 Series B FRN versions 21.2 and before

Description: The issue allows for an exploitable access control vulnerability in the data, program, and function file permissions functionality. This can be triggered by a specially crafted packet, resulting in the disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to exploit this issue. The vulnerability can be triggered by requesting a specific set of bytes from an undocumented data file, which returns the ASCII version of the master password.

Recommendations: For Allen Bradley Micrologix 1400 Series B FRN versions 21.2 and before, consider restricting access to the undocumented data file to minimize the risk of exploitation. As a temporary workaround, limit the ability to send unauthenticated packets to the device until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2017-14472

Produtos afetados

Allen Bradley Micrologix 1400 Series B

Referências · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0443 · Exploit
• https://osv.dev/vulnerability/CVE-2017-14472 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-14472 · Nota de Segurança