CVE-2015-6492 in MicroLogix
Summary
by MITRE
Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of service (memory corruption and device crash) via a crafted HTTP request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/03/2026
The CVE-2015-6492 vulnerability affects Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers where specific firmware versions fail to properly validate incoming HTTP requests. This flaw represents a critical security weakness in industrial control systems that can be exploited remotely to disrupt operations. The vulnerability exists within the web server component of these devices, which handles HTTP communications for configuration and monitoring purposes. When malicious actors send specially crafted HTTP requests to these controllers, the devices experience memory corruption that ultimately leads to system crashes and complete service disruption. This type of vulnerability directly impacts the availability aspect of the CIA triad and poses significant operational risks to industrial environments where continuous operation is essential.
The technical nature of this vulnerability stems from improper input validation within the HTTP request handling mechanism of the affected controllers. The flaw allows attackers to manipulate memory structures through malformed HTTP requests, causing the device to behave unpredictably and eventually crash. This memory corruption occurs during the processing of HTTP headers or body content, where insufficient bounds checking and validation routines fail to properly sanitize user-supplied data. The vulnerability specifically affects devices running firmware versions prior to B FRN 15.000 for 1100 series and B FRN 15.003 for 1400 series, indicating that these were known issues that required firmware updates to resolve. The lack of proper request validation creates a pathway for remote code execution potential and can be leveraged to cause extended downtime in industrial control environments.
From an operational impact perspective, this vulnerability presents severe risks to industrial automation systems that rely on continuous operation for safety and productivity. When these controllers crash due to crafted HTTP requests, production lines may halt unexpectedly, leading to significant financial losses and potential safety hazards. The remote nature of the attack means that threat actors can exploit this vulnerability from anywhere on the network without requiring physical access to the devices. This makes the vulnerability particularly dangerous in environments where industrial control systems are connected to corporate networks or the internet. The denial of service condition can persist until manual intervention occurs, requiring system administrators to restart the affected devices or apply firmware updates to restore normal operations. Organizations using these controllers face potential regulatory compliance issues if such disruptions occur, as they may not meet industrial security standards.
Organizations should implement immediate mitigations to address this vulnerability by upgrading to the affected firmware versions that contain the necessary patches. The recommended approach involves updating both the 1100 and 1400 series devices to firmware releases B FRN 15.000 and B FRN 15.003 respectively, which contain fixes for the HTTP request validation issues. Network segmentation and access controls should be implemented to limit exposure of these devices to untrusted networks, as suggested by the mitre ATT&CK framework's network infiltration techniques. Additionally, monitoring network traffic for suspicious HTTP requests and implementing intrusion detection systems can help identify potential exploitation attempts. The vulnerability aligns with CWE-121, which describes heap-based buffer overflow conditions, and represents a classic example of insufficient input validation that can lead to memory corruption. Organizations should also consider implementing network access control lists to restrict HTTP access to these devices and maintain proper inventory tracking of all industrial control system components to ensure timely patch deployment across all affected devices.