#VU11606 Improper authentication in Allen-Bradley MicroLogix 1400 - CVE-2017-12089

Vulnerability identifier: #VU11606

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-12089

CWE-ID: CWE-287

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Allen-Bradley MicroLogix 1400
Hardware solutions / Office equipment, IP-phones, print servers

Vendor: Rockwell Automation

Description
The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the program download functionality due to improper authentication. A remote attacker can submit a specially crafted packet that does not indicate the download is complete to the controller during the standard download process and cause the service to crash.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Allen-Bradley MicroLogix 1400: B FRN 21.0 - B FRN 21.2

---

External links
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0441
https://ics-cert.us-cert.gov/advisories/ICSA-18-095-01

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.