PT-2015-2585 · Allen Bradley · Allen-Bradley Micrologix 1400+1

Ilya Karpov · Published 2015-10-28 · Updated 2015-10-28 · CVE-2015-6488

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Allen-Bradley MicroLogix 1100 versions before B FRN 15.000 Allen-Bradley MicroLogix 1400 versions before B FRN 15.003

Description The issue is related to a cross-site scripting (XSS) vulnerability in the web server of the affected devices. This vulnerability exists due to the lack of protection for the web page structure, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Exploitation of this vulnerability may enable an attacker to execute arbitrary code when a user navigates to a specially crafted link.

Recommendations For Allen-Bradley MicroLogix 1100 versions before B FRN 15.000, update to version B FRN 15.000 or later. For Allen-Bradley MicroLogix 1400 versions before B FRN 15.003, update to version B FRN 15.003 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11950

BDU:2016-01725

CVE-2015-6488

Affected Products

Allen-Bradley Micrologix 1100

Allen-Bradley Micrologix 1400

References · 5

• https://bdu.fstec.ru/vul/2015-11950 · Security Note
• https://bdu.fstec.ru/vul/2016-01725 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-15-300-03 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-6488 · Security Note
• http://securitylab.ru/lab/PT-2016-16 · Note