PT-2016-6612 · Rockwell Automation · Micrologix 1400 Plc

Published 2016-08-24 · Updated 2016-11-28 · CVE-2016-5645

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Rockwell Automation MicroLogix 1400 PLC versions 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, 1766-L32BXBA

Description The issue concerns a hardcoded SNMP community in the affected devices, making it easier for remote attackers to load arbitrary firmware updates by leveraging knowledge of this community.

Recommendations For versions 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA, 1766-L32BXBA, consider changing the hardcoded SNMP community string to a unique and secure value to prevent unauthorized access. As a temporary workaround, restrict access to the SNMP service to minimize the risk of exploitation. Avoid using default or easily guessable community strings in the affected devices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-5645

Affected Products

Micrologix 1400 Plc

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2016-5645 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-224-01 · Note
• http://securityfocus.com/bid/92428 · Note