Use of Hard-coded Cryptographic Key in Rockwell Automation products - CVE-2020-6990
Published: March 11, 2020
Vulnerability identifier: #VU25989
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2020-6990
CWE-ID: CWE-321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Rockwell Automation
Affected software:
MicroLogix 1400 Controllers Series A
MicroLogix 1400 Controllers Series B
Allen-Bradley MicroLogix 1100
RSLogix 500 Software
MicroLogix 1400 Controllers Series A
MicroLogix 1400 Controllers Series B
Allen-Bradley MicroLogix 1100
RSLogix 500 Software
Detailed vulnerability description
The vulnerability allows a remote attacker to disclose sensitive information on the target system.
The vulnerability exists due to the cryptographic key utilized to help protect the account password is hard coded into the RSLogix 500 binary file. A remote attacker can identify cryptographic keys.
How to mitigate CVE-2020-6990
Install updates from vendor's website.