7.8 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 High
AI Score
Confidence
High
0.974 High
EPSS
Percentile
99.9%
CVSS v3 8.6
**ATTENTION:**Exploitable remotely/low skill level to exploit
**Vendor:**Rockwell Automation
**Equipment:**Allen-Bradley Stratix 5950
**Vulnerabilities:**Improper Input Validation, Improper Certificate Validation, Resource Management Errors
Successful exploitation of these vulnerabilities could allow an attacker to bypass client certification to create connections to the affected device or cause the device to crash.
The Allen-Bradley Stratix 5950 uses the Cisco Systems, Inc., Adaptive Security Appliance (ASA) as its central operating system. Cisco has released advisories disclosing multiple vulnerabilities in the ASA software.
The following Allen-Bradley Stratix 5950 Security Appliances, running the Cisco ASA v9.6.2 and earlier, are affected:
A vulnerability in the ingress flow creation functionality of the Cisco ASA could allow an unauthenticated, remote threat actor to cause the CPU to increase upwards of 100 percent utilization, causing a denial-of-service (DoS) condition on an affected system.
CVE-2018-0228 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for the Cisco ASA could allow an unauthenticated, remote threat actor to establish an SSL VPN connection and bypass certain SSL certificate verification steps.
CVE-2018-0227 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
A vulnerability in the Transport Layer Security library of the Cisco ASA Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote threat actor to trigger a reload of the affected device, resulting in a DoS condition.
CVE-2018-0231 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
Multiple vulnerabilities in the Application Layer Protocol Inspection feature of the Cisco ASA Software and Cisco FTD Software could allow an unauthenticated, remote threat actor to trigger a reload of an affected device, resulting in a DoS condition.
CVE-2018-0240 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
A vulnerability in the web interface of the Cisco ASA could allow an unauthenticated, remote threat actor to cause an affected device to reload unexpectedly, resulting in a DoS condition. It is also possible on certain software releases that the ASA will not reload, but a threat actor could view sensitive system information without authentication by using directory traversal techniques.
CVE-2018-0296 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
Rockwell Automation reported these vulnerabilities to NCCIC.
Rockwell Automation will inform users of updated firmware as soon as it is available. Rockwell Automation recommends that users using affected devices apply the following risk mitigation strategies:
For additional information please see the Rockwell Automation security notification at (login required): https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1073860
Additionally the Cisco advisories can be found at the following links:
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2>
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1>
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3>
<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd>
NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01BβTargeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
NCCIC also recommends that users take the following measures to protect themselves from social engineering attacks:
No known public exploits specifically target these vulnerabilities.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-0227
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-0228
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-0231
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-0240
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-0296
cwe.mitre.org/data/definitions/20.html
cwe.mitre.org/data/definitions/20.html
cwe.mitre.org/data/definitions/20.html
cwe.mitre.org/data/definitions/295.html
cwe.mitre.org/data/definitions/399.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa1
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa2
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa3
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asa_inspect
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-asaftd
twitter.com/CISAgov
twitter.com/intent/tweet?text=Rockwell%20Automation%20Allen-Bradley%20Stratix%205950+https://www.cisa.gov/news-events/ics-advisories/icsa-18-184-01
urldefense.proofpoint.com/v2/url?u=https-3A__rockwellautomation.custhelp.com_app_answers_detail_a-5Fid_1073860&d=DwMGaQ&c=54IZrppPQZKX9mLzcGdPfFD1hxrcB__aEkJFOKJFd00&r=zE5lG3CZZIbdBvT6slVAzQ&m=d7_uax5LG0vjWoCGwelqASZRyzRGG85aflD3xxdn7I4&s=QsGtt5inxh43clly39aymIsyKWnoKwawSFbQUhiVVhA&e=
www.cisco.com/web/software/286271056/117258/sf-rules-2018-06-07-new.html
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-18-184-01&title=Rockwell%20Automation%20Allen-Bradley%20Stratix%205950
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-18-184-01
www.oig.dhs.gov/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-advisories/icsa-18-184-01
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Rockwell%20Automation%20Allen-Bradley%20Stratix%205950&body=www.cisa.gov/news-events/ics-advisories/icsa-18-184-01
7.8 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:N/I:N/A:C
8.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
8.6 High
AI Score
Confidence
High
0.974 High
EPSS
Percentile
99.9%