Allen Bradley MicroLogix 1400 up to 21.2 Crafted Packet access control

Summaryinfo

A vulnerability, which was classified as critical, was found in Allen Bradley MicroLogix 1400 up to 21.2. Affected by this vulnerability is an unknown functionality. Executing a manipulation as part of Crafted Packet can lead to access control. This vulnerability is tracked as CVE-2017-14464. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability has been found in Allen Bradley MicroLogix 1400 up to 21.2 and classified as critical. This vulnerability affects some unknown functionality. The manipulation as part of a Crafted Packet leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability.Required Keyswitch State: REMOTE or PROG Associated Fault Code: 0001 Fault Type: Non-User Description: A fault state can be triggered by setting the NVRAM/memory module user program mismatch bit (S2:9) when a memory module is NOT installed.

The bug was discovered 03/28/2018. The weakness was disclosed 04/05/2018 (Website). The advisory is shared for download at talosintelligence.com. This vulnerability was named CVE-2017-14464 since 09/13/2017. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

The vulnerability was handled as a non-public zero-day exploit for at least 8 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-115850, VDB-115851, VDB-115853 and VDB-115854 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Allen Bradley

Name

• MicroLogix 1400

Version

• 21.0
• 21.1
• 21.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion