Rockwell Automation Micrologix 1400 <= 21.2 Float Value Exploit

critical Nessus Network Monitor Plugin ID 720223

Synopsis

Rockwell Automation Micrologix 1400 allows a remote attacker to obtain sensitive information or modification of ladder logic via specially crafted unauthenticated packets.

Description

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG or RUN Description: The value 0xffffffff is considered NaN for the Float data type. When a float is set to this value and used in the PLC, a fault is triggered. NOTE: This is not possible through RSLogix.

Solution

Perform vendor recommended mitigations and apply available vendor upgrades.

Plugin Details

Severity: Critical

ID: 720223

Family: SCADA

Published: 5/8/2019

Updated: 9/30/2019

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 4/5/2018

Vulnerability Publication Date: 4/5/2018

Reference Information

CVE: CVE-2017-14470

Detections

Analytics