CVE-2018-17924: High severity rockwellautomation Micrologix 1400 Firmware vulnerability

Q: What is CVE-2018-17924?

CVE-2018-17924 is a vulnerability that affects Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules.

Q: How does CVE-2018-17924 impact Rockwell Automation devices?

CVE-2018-17924 allows an unauthenticated remote attacker to send a new IP configuration to affected devices even if the controller is non-configurable.

Q: What is the severity of CVE-2018-17924?

CVE-2018-17924 has a severity score of 8.6 (high).

Q: Is CVE-2018-17924 exploitable remotely?

Yes, CVE-2018-17924 can be exploited remotely by an unauthenticated threat actor.

Q: How can I mitigate the vulnerability CVE-2018-17924?

Apply the appropriate security patches and updates provided by Rockwell Automation to address CVE-2018-17924.

Published Dec 7, 2018

Updated

Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address.

Affected Software

64 affected components

rockwellautomation Micrologix 1400 Firmware

rockwellautomation Micrologix 1400

rockwellautomation 1756-enbt Firmware

rockwellautomation 1756-enbt

rockwellautomation 1756-eweb Series A Firmware

rockwellautomation 1756-eweb Series A

rockwellautomation 1756-eweb Series B Firmware

rockwellautomation 1756-eweb Series B

rockwellautomation 1756-en2f Series A Firmware

rockwellautomation 1756-en2f Series A

rockwellautomation 1756-en2f Series B Firmware

rockwellautomation 1756-en2f Series B

rockwellautomation 1756-en2f Series C Firmware<=10.10

rockwellautomation 1756-en2f Series C

rockwellautomation 1756-en2t Series A Firmware

rockwellautomation 1756-en2t Series A

rockwellautomation 1756-en2t Series B Firmware

rockwellautomation 1756-en2t Series B

rockwellautomation 1756-en2t Series C Firmware

rockwellautomation 1756-en2t Series C

rockwellautomation 1756-en2t Series D Firmware<=10.10

rockwellautomation 1756-en2t Series D

rockwellautomation 1756-en2tr Series A Firmware

rockwellautomation 1756-en2tr Series A

rockwellautomation 1756-en2tr Series B Firmware

rockwellautomation 1756-en2tr Series B

rockwellautomation 1756-en2tr Series C Firmware<=10.10

rockwellautomation 1756-en2tr Series C

rockwellautomation 1756-en3tr Series A Firmware

rockwellautomation 1756-en3tr Series A

rockwellautomation 1756-en3tr Series B Firmware<=10.10

rockwellautomation 1756-en3tr Series B

All of the following

rockwellautomation Micrologix 1400 Firmware

rockwellautomation Micrologix 1400

All of the following

rockwellautomation 1756-enbt Firmware

rockwellautomation 1756-enbt

All of the following

rockwellautomation 1756-eweb Series A Firmware

rockwellautomation 1756-eweb Series A

All of the following

rockwellautomation 1756-eweb Series B Firmware

rockwellautomation 1756-eweb Series B

All of the following

rockwellautomation 1756-en2f Series A Firmware

rockwellautomation 1756-en2f Series A

All of the following

rockwellautomation 1756-en2f Series B Firmware

rockwellautomation 1756-en2f Series B

All of the following

rockwellautomation 1756-en2f Series C Firmware<=10.10

rockwellautomation 1756-en2f Series C

All of the following

rockwellautomation 1756-en2t Series A Firmware

rockwellautomation 1756-en2t Series A

All of the following

rockwellautomation 1756-en2t Series B Firmware

rockwellautomation 1756-en2t Series B

All of the following

rockwellautomation 1756-en2t Series C Firmware

rockwellautomation 1756-en2t Series C

All of the following

rockwellautomation 1756-en2t Series D Firmware<=10.10

rockwellautomation 1756-en2t Series D

All of the following

rockwellautomation 1756-en2tr Series A Firmware

rockwellautomation 1756-en2tr Series A

All of the following

rockwellautomation 1756-en2tr Series B Firmware

rockwellautomation 1756-en2tr Series B

All of the following

rockwellautomation 1756-en2tr Series C Firmware<=10.10

rockwellautomation 1756-en2tr Series C

All of the following

rockwellautomation 1756-en3tr Series A Firmware

rockwellautomation 1756-en3tr Series A

All of the following

rockwellautomation 1756-en3tr Series B Firmware<=10.10

rockwellautomation 1756-en3tr Series B

Event History

Dec 7, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Data Sourced

via NVD·02:29 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is CVE-2018-17924?

CVE-2018-17924 is a vulnerability that affects Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules.

How does CVE-2018-17924 impact Rockwell Automation devices?

CVE-2018-17924 allows an unauthenticated remote attacker to send a new IP configuration to affected devices even if the controller is non-configurable.

What is the severity of CVE-2018-17924?

CVE-2018-17924 has a severity score of 8.6 (high).

Is CVE-2018-17924 exploitable remotely?

Yes, CVE-2018-17924 can be exploited remotely by an unauthenticated threat actor.

How can I mitigate the vulnerability CVE-2018-17924?

Apply the appropriate security patches and updates provided by Rockwell Automation to address CVE-2018-17924.

CVE-2018-17924: High severity rockwellautomation Micrologix 1400 Firmware vulnerability

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is CVE-2018-17924?

How does CVE-2018-17924 impact Rockwell Automation devices?

What is the severity of CVE-2018-17924?

Is CVE-2018-17924 exploitable remotely?

How can I mitigate the vulnerability CVE-2018-17924?

Company

Resources

Contact