Rockwell Automation Allen-Bradley MicroLogix controller 1100, 1200, 1400, and 1500; SLC 500 controller platform; and PLC-5 controller platform, when Static status is not enabled, allow remote attackers to cause a denial of service via messages that trigger modification of status bits.

Rockwell Automation Allen-Bradley MicroLogix controller 1100, 1200, 1400, and 1500; SLC 500 controller platform; and PLC-5 controller platform, when Static status is not enabled, allow remote attackers to cause a denial of service via messages that trigger modification of status bits.  

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

The installed firmware on the remote Allen-Bradley MicroLogix 1400 controller is affected by multiple vulnerabilities :

  - A flaw exists when handling messages that modify     specific bits in status files. An unauthenticated,     remote attacker can exploit this, via a specially     crafted message, to cause a denial of service     condition. (CVE-2012-4690)

  - A flaw exists in the Ethernet/IP protocol implementation     when handling a CIP message that specifies a     logic-execution 'stop' command. An unauthenticated,     remote attacker can exploit this, via a specially     crafted message, to cause a denial of service condition.
    (CVE-2012-6435)

  - A buffer overflow condition exists due to improper     validation of user-supplied input when parsing CIP     packets. An unauthenticated, remote attacker can exploit     this, via a malformed packet, to cause a denial of     service condition. (CVE-2012-6436, CVE-2012-6438)

  - A flaw exists due to a failure to properly authenticate     Ethernet firmware updates. An unauthenticated, remote     attacker can exploit this, via a trojan horse update     image, to execute arbitrary code. (CVE-2012-6437)

  - A flaw exists when handling CIP messages that modify     network and configuration parameters. An     unauthenticated, remote attacker can exploit this, via a     specially crafted message, to cause a denial of service     condition. (CVE-2012-6439)

  - A flaw exists due to a failure to properly restrict     session replaying. A man-in-the-middle attacker can     exploit this, via HTTP traffic, to conduct a replay     attack. (CVE-2012-6440)

  - An information disclosure vulnerability exists in the     Ethernet/IP protocol implementation when handling the     'dump' command. An unauthenticated, remote attacker     can exploit this, via a specially crafted CIP packet,     to disclose the boot code of the device. (CVE-2012-6441)

  - A flaw exists in the Ethernet/IP protocol implementation     when handling a CIP message that specifies a 'reset'     command. An unauthenticated, remote attacker can exploit     this, via a specially crafted message, to cause a denial     of service condition. (CVE-2012-6442)

Note that Nessus has not tested for these issues but has instead relied only on the firmware's self-reported version number.

ID	Name	Product	Family	Severity
500257	Rockwell Automation MicroLogix Denial Of Service (CVE-2012-4690)	Tenable OT Security	Tenable.ot	high
720023	Rockwell Automation Allen-Bradley Multiple Controllers Multiple Versions Denial of Service	Nessus Network Monitor	SCADA	high
91345	Allen-Bradley MicroLogix 1400 Multiple Vulnerabilities	Nessus	SCADA	critical

Detections

Analytics

CVE-2012-4690

high

Tenable Plugins

high

high

critical