Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules Missing Authentication For Critical Function (CVE-2018-17924)

high Tenable OT Security Plugin ID 500154

Synopsis

The remote OT asset is affected by a vulnerability.

Description

Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address.

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Rockwell Automation recommends users of affected products update to an available firmware revision that addresses the associated risk. Users who are unable to update their firmware are directed towards additional risk mitigation strategies provided herein and are encouraged to combine these with the general security guidelines to employ multiple strategies simultaneously, when possible.

Rockwell Automation suggests the following actions for affected versions:

- MicroLogix 1400 Controllers 1766-Lxxx, Series A, no direct mitigation provided. See additional mitigating recommendations below for suggested actions.
- For MicroLogix 1400 Controllers 1766-Lxxx, Series B or C, apply FRN 21.004 and later. Once the new FRN is applied, use the LCD Display to put the controller in RUN mode to prevent configuration changes. See p. 115 of the MicroLogix 1400 Programmable Controllers User Manual (1766-UM001M-EN-P) for details (available at the following location):

https://literature.rockwellautomation.com/idc/groups/literature/documents/um/1766-um001_-en-p.pdf

The download for FRN 21.004 can be found at the following location:

https://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=1766-L&crumb=112

Plugin Details

Severity: High

ID: 500154

Version: 1.7

Type: remote

Family: Tenable.ot

Published: 2/7/2022

Updated: 9/4/2024

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2018-17924

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:rockwellautomation:1756-en2f_series_a_firmware:-, cpe:/o:rockwellautomation:1756-en2t_series_d_firmware, cpe:/o:rockwellautomation:1756-en2t_series_b_firmware:-, cpe:/o:rockwellautomation:1756-enbt_firmware:-, cpe:/o:rockwellautomation:1756-en2t_series_c_firmware:-, cpe:/o:rockwellautomation:1756-en3tr_series_b_firmware, cpe:/o:rockwellautomation:1756-en2t_series_a_firmware:-, cpe:/o:rockwellautomation:1756-en2tr_series_b_firmware:-, cpe:/o:rockwellautomation:1756-en2tr_series_a_firmware:-, cpe:/o:rockwellautomation:1756-en2tr_series_c_firmware, cpe:/o:rockwellautomation:1756-eweb_series_a_firmware:-, cpe:/o:rockwellautomation:1756-en2f_series_b_firmware:-, cpe:/o:rockwellautomation:1756-eweb_series_b_firmware:-, cpe:/o:rockwellautomation:1756-en2f_series_c_firmware, cpe:/o:rockwellautomation:1756-en3tr_series_a_firmware:-, cpe:/o:rockwellautomation:micrologix_1400_firmware:-

Required KB Items: Tenable.ot/Rockwell

Exploit Ease: No known exploits are available

Patch Publication Date: 12/7/2018

Vulnerability Publication Date: 12/7/2018

Reference Information

CVE: CVE-2018-17924

CWE: 306

ICSA: 18-310-02

Detections

Analytics