Lucene search

TalosCVE-2017-14473

HistoryApr 05, 2018 - 9:29 p.m.

CVE-2017-14473

2018-04-0521:29:01

talos

web.nvd.nist.gov

cve-2017-14473

access control vulnerability

allen bradley micrologix 1400

data file permissions

program file permissions

function file permissions

packet vulnerability

unauthenticated packets

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

43.4%

JSON

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: Any Description: Reads the encoded ladder logic from its data file and print it out in HEX.

Affected configurations

Nvd

Vulners

Node

rockwellautomationmicrologix_1400_b_firmwareRange≤21.2

AND

rockwellautomationmicrologix_1400Match-

VendorProductVersionCPE
rockwellautomationmicrologix_1400_b_firmware*cpe:2.3:o:rockwellautomation:micrologix_1400_b_firmware:*:*:*:*:*:*:*:*
rockwellautomationmicrologix_1400-cpe:2.3:h:rockwellautomation:micrologix_1400:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rockwellautomation	micrologix_1400_b_firmware	*	cpe:2.3:o:rockwellautomation:micrologix_1400_b_firmware::::::::
rockwellautomation	micrologix_1400	-	cpe:2.3:h:rockwellautomation:micrologix_1400:-:::::::*

CNA Affected

[
  {
    "product": "Allen Bradley",
    "vendor": "Talos",
    "versions": [
      {
        "status": "affected",
        "version": "Allen Bradley Micrologix 1400 Series B FRN 21.2, Allen Bradley Micrologix 1400 Series B FRN 21.0, Allen Bradley Micrologix 1400 Series B FRN 15"
      }
    ]
  }
]

References

www.talosintelligence.com/vulnerability_reports/TALOS-2017-0443

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.1

Confidence

High

EPSS

0.001

Percentile

43.4%

JSON

Related for CVE-2017-14473