PT-2017-10073 · Rockwell Automation · Logix5000

Published 2017-02-13 · Updated 2022-02-03 · CVE-2016-9343

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation Logix5000 Programmable Automation Controller versions 16.00 through 21.00

Description An issue allows an attacker to potentially execute code on the controller or initiate a denial of service by sending a malformed common industrial protocol (CIP) packet, which can overflow a stack-based buffer.

Recommendations For versions 16.00 through 21.00, consider restricting access to the CIP protocol until a fix is available to prevent potential exploitation.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2016-9343

Affected Products

Logix5000

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9343 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9343 · Vendor Advisory
• http://securityfocus.com/bid/95304 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-343-05 · Note