PT-2018-5341 · Allen Bradley · Micrologix 1400 Series B

Published 2018-04-05 · Updated 2022-04-19 · CVE-2017-12088

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Allen Bradley Micrologix 1400 Series B versions 21.2 and below

Description A denial of service issue exists in the Ethernet functionality, allowing an attacker to send a specially crafted packet that can cause a device power cycle. This results in a fault state and deletion of ladder logic. The attack can be triggered by sending one unauthenticated packet.

Recommendations For versions 21.2 and below, consider restricting access to the Ethernet functionality until a fix is available. As a temporary workaround, implement network segmentation to limit the exposure of affected devices to untrusted networks.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-12088

Affected Products

Micrologix 1400 Series B

References · 3

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0440 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-12088 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12088 · Vendor Advisory