Detections
Analytics
Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers Buffer Copy Without Checking Size of Input (CVE-2017-16740)
critical Tenable OT Security Plugin ID 500213
Synopsis
The remote OT asset is affected by a vulnerability.Description
A Buffer Overflow issue was discovered in Rockwell Automation Allen- Bradley MicroLogix 1400 Controllers, Series B and C Versions 21.002 and earlier. The stack-based buffer overflow vulnerability has been identified, which may allow remote code execution.This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.Rockwell Automation encourages affected users to upgrade to the latest version of available firmware, FRN 21.003, which can be obtained from:
https://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?famID=30&crumb=112
Rockwell Automation also suggests that Modbus TCP can be disabled if it is not necessary in the implementation of the device to mitigate the vulnerability.
For more information, Rockwell Automation has released a security bulletin that can be accessed using valid credentials at:
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1070883
See Also
https://ics-cert.us-cert.gov/advisories/ICSA-18-009-01
Plugin Details
Severity: Critical
ID: 500213
Version: 1.11
Type: remote
Family: Tenable.ot
Published: 2/7/2022
Updated: 11/24/2024
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Medium
Score: 6.5
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2017-16740
CVSS v3
Risk Factor: Critical
Base Score: 10
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/o:rockwellautomation:1766-l32bwaa_firmware, cpe:/o:rockwellautomation:1766-l32awa_firmware, cpe:/o:rockwellautomation:1766-l32bxba_firmware, cpe:/o:rockwellautomation:1766-l32bwa_firmware, cpe:/o:rockwellautomation:1766-l32awaa_firmware, cpe:/o:rockwellautomation:1766-l32bxb_firmware
Required KB Items: Tenable.ot/Rockwell
Exploit Ease: No known exploits are available
Patch Publication Date: 1/9/2018
Vulnerability Publication Date: 1/9/2018
Reference Information
CVE: CVE-2017-16740