CVE-2017-14469
First published: Wed Mar 28 2018(Updated: )
An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG Associated Fault Code: 0028 Fault Type: Non-User Description: Values 0x01 and 0x02 are invalid values for the user fault routine. By writing directly to the file it is possible to set these values. When this is done and the device is moved into a run state, a fault is triggered. NOTE: This is not possible through RSLogix.
Credit: talos-cna@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwellautomation Micrologix 1400 B Firmware | <=21.2 | |
| Rockwellautomation Micrologix 1400 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2017-14469?
CVE-2017-14469 is an exploitable access control vulnerability in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before.
How severe is CVE-2017-14469?
CVE-2017-14469 has a severity rating of 9.8 (Critical).
What software is affected by CVE-2017-14469?
The Rockwell Automation Micrologix 1400 Series B firmware up to and including version 21.2 is affected by CVE-2017-14469.
What is the risk of CVE-2017-14469?
CVE-2017-14469 can be exploited to disclose sensitive information and modify data.
How can I fix CVE-2017-14469?
To fix CVE-2017-14469, it is recommended to update to a firmware version that is not vulnerable.
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/rockwellautomation
- canonical/rockwellautomation micrologix 1400 b firmware
- version/rockwellautomation micrologix 1400 b firmware/21.2
- canonical/rockwellautomation micrologix 1400