Use of Hard-coded Cryptographic Key in Rockwell Automation products - CVE-2020-6990
Published: March 11, 2020
Vulnerability identifier: #VU25989
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6990
CWE-ID: CWE-321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information on the target system.
The vulnerability exists due to the cryptographic key utilized to help protect the account password is hard coded into the RSLogix 500 binary file. A remote attacker can identify cryptographic keys.
Affected software
MicroLogix 1400 Controllers Series A
MicroLogix 1400 Controllers Series B
Allen-Bradley MicroLogix 1100
RSLogix 500 Software
MicroLogix 1400 Controllers Series B
Allen-Bradley MicroLogix 1100
RSLogix 500 Software
How to mitigate CVE-2020-6990
Install updates from vendor's website.
MicroLogix 1400 Controllers Series B - update to 21.002
RSLogix 500 Software - update to 11.00.00
RSLogix 500 Software - update to 11.00.00