PT-2018-2759 · Rockwell Automation · Micrologix 1400+1

David Noren · Published 2018-12-07 · Updated 2022-05-02 · CVE-2018-17924

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules (affected versions not specified)

Description The issue is related to a lack of authentication for a critical function in the MicroLogix 1400 and 1756 ControlLogix software. An unauthenticated, remote threat actor could send a CIP connection request to an affected device and, upon successful connection, send a new IP configuration to the affected device, even if the controller is set to Hard RUN mode. This can cause a loss of communication between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address. The exploitation of this issue can allow a remote attacker to cause a denial of service by connecting via the CIP protocol and sending an IP configuration to the vulnerable device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2019-01739

CVE-2018-17924

Affected Products

1756 Controllogix

Micrologix 1400

References · 6

• https://bdu.fstec.ru/vul/2019-01739 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17924 · Security Note
• http://securityfocus.com/bid/106132 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-310-02 · Note
• https://securitylab.ru/vulnerability/496887.php · Note