CVE-2017-7901 in MicroLogix 1100
Summary
by MITRE
A Predictable Value Range from Previous Values issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and B, Version 16.00 and prior versions; 1763-L16BBB, Series A and B, Version 16.00 and prior versions; 1763-L16BWA, Series A and B, Version 16.00 and prior versions; and 1763-L16DWD, Series A and B, Version 16.00 and prior versions and Allen-Bradley MicroLogix 1400 programmable logic controllers 1766-L32AWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWA, Series A and B, Version 16.00 and prior versions; 1766-L32BWAA, Series A and B, Version 16.00 and prior versions; 1766-L32BXB, Series A and B, Version 16.00 and prior versions; 1766-L32BXBA, Series A and B, Version 16.00 and prior versions; and 1766-L32AWAA, Series A and B, Version 16.00 and prior versions. Insufficiently random TCP initial sequence numbers are generated, which may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections, resulting in a denial of service for the target device.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 12/25/2020
The vulnerability identified as CVE-2017-7901 represents a critical weakness in the network security architecture of Rockwell Automation's Allen-Bradley MicroLogix series programmable logic controllers. This issue specifically affects multiple models including the 1100 and 1400 series controllers, all running firmware versions 16.00 or earlier. The flaw manifests in the generation of TCP initial sequence numbers, which are fundamental components in the Transmission Control Protocol that ensure reliable data transmission across networks. These sequence numbers must be unpredictable to prevent various forms of network attacks that rely on sequence number prediction.
The technical implementation of this vulnerability stems from insufficient randomness in the generation algorithm for TCP initial sequence numbers. According to the common weakness enumeration standard CWE-330, this represents a weakness in randomness where the generated values are predictable, making them vulnerable to cryptographic attacks. The predictable nature of these sequence numbers allows attackers to anticipate future values based on previously observed sequences, fundamentally undermining the security of TCP connections. This weakness directly relates to the principles outlined in the MITRE ATT&CK framework under the technique T1071.004 for application layer protocol and T1499.004 for network disruption.
The operational impact of this vulnerability extends beyond simple network disruption to encompass potential system compromise and industrial control system (ICS) security breaches. An attacker exploiting this vulnerability can perform TCP sequence number prediction attacks that enable them to inject malicious packets into legitimate TCP sessions, effectively allowing for man-in-the-middle attacks or session hijacking. This capability can result in unauthorized access to control systems, potentially leading to operational disruptions, data manipulation, or even physical safety hazards in industrial environments where these controllers manage critical processes. The denial of service condition mentioned in the vulnerability description can be particularly devastating in industrial settings where continuous operation is essential for safety and productivity.
Organizations utilizing affected MicroLogix controllers should implement immediate mitigations including firmware updates to the latest available versions that address the predictable sequence number generation issue. Network segmentation and access controls should be strengthened to limit exposure of these devices to untrusted networks. Additionally, implementing network monitoring solutions capable of detecting anomalous TCP sequence number patterns can provide early warning of potential exploitation attempts. The vulnerability highlights the critical importance of proper entropy sources in embedded systems and industrial control environments, where predictable values can have catastrophic consequences. Security professionals should also consider implementing intrusion detection systems specifically configured to monitor for TCP sequence number prediction attacks and maintain comprehensive network traffic analysis capabilities to detect unauthorized access attempts.