PT-2020-1768 · Rockwell Automation · Rslogix 500+2

Published 2020-03-05 · Updated 2020-03-20 · CVE-2020-6980

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Rockwell Automation MicroLogix 1400 Controllers versions prior to Series B v21.001 Rockwell Automation MicroLogix 1100 Controller all versions RSLogix 500 Software versions prior to v12.001

Description The issue is related to the Simple Mail Transfer Protocol (SMTP) in the affected software, where critical information is stored unencrypted. This allows an attacker to gain access to confidential information, specifically SMTP server authentication data, if they have access to a victim's project file. The data is written to the project file in cleartext.

Recommendations For Rockwell Automation MicroLogix 1400 Controllers versions prior to Series B v21.001, update to Series B v21.001 or later to resolve the issue. For Rockwell Automation MicroLogix 1100 Controller all versions, consider restricting access to project files to minimize the risk of exploitation. For RSLogix 500 Software versions prior to v12.001, avoid saving Simple Mail Transfer Protocol (SMTP) account data in RSLogix 500 until a patch is available.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BDU:2020-01009

CVE-2020-6980

Affected Products

Micrologix 1100 Controller

Micrologix 1400 Controllers

Rslogix 500

References · 5

• https://osv.dev/vulnerability/CVE-2020-6980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6980 · Security Note
• https://bdu.fstec.ru/vul/2020-01009 · Security Note
• https://us-cert.gov/ics/advisories/icsa-20-070-06 · Note
• https://cybersecurity-help.cz/vdb/SB2020031124 · Note