Denial of service in Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix

1) Missing authentication for critical function

EUVDB-ID: #VU16330

Risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-17924

CWE-ID: CWE-306 - Missing Authentication for Critical Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to a loss of communication between the device and the rest of the system when the affected device accepts this new IP configuration as the system traffic is still attempting to communicate with the device via the overwritten IP address.. A remote attacker can send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode.

Mitigation

Install update from vendor's website.

Vulnerable software versions

1756-EN3TR Series B: All versions

1756-EN3TR Series A: All versions

1756-EN2TR Series C: All versions

1756-EN2TR Series B: All versions

1756-EN2TR Series A: All versions

1756-EN2T Series D: All versions

1756-EN2T Series C: All versions

1756-EN2T Series B: All versions

1756-EN2T Series A: All versions

1756-EN2F Series C: All versions

1756-EN2F Series B: All versions

1756-EN2F Series A: All versions

1756-EWEB Series B: All versions

1756-EWEB Series A: All versions

1756-ENBT: All versions

MicroLogix 1400 Controller Series C: All versions

MicroLogix 1400 Controllers Series B: All versions

MicroLogix 1400 Controllers Series A: All versions

External links

http://ics-cert.us-cert.gov/advisories/ICSA-18-310-02

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.