Allen Bradley MicroLogix 1400 up to 21.2 snmp-set Command Request resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in Allen Bradley MicroLogix 1400 up to 21.2. The affected element is an unknown function of the component snmp-set Command Handler. The manipulation as part of Request leads to resource consumption. This vulnerability is uniquely identified as CVE-2017-12090. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Allen Bradley MicroLogix 1400 up to 21.2. It has been rated as problematic. This issue affects an unknown code of the component snmp-set Command Handler. The manipulation as part of a Request leads to a resource consumption vulnerability. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. Impacted is availability. The summary by CVE is:

An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A specially crafted snmp-set request, when sent without associated firmware flashing snmp-set commands, can cause a device power cycle resulting in downtime for the device. An attacker can send one packet to trigger this vulnerability.

The bug was discovered 03/28/2018. The weakness was disclosed 04/05/2018 (Website). It is possible to read the advisory at talosintelligence.com. The identification of this vulnerability is CVE-2017-12090 since 07/31/2017. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-115851, VDB-115850, VDB-115848 and VDB-115845 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Allen Bradley

Name

• MicroLogix 1400

Version

• 21.0
• 21.1
• 21.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion