Vulnerability identifier: #VU16330

Vulnerability risk: Medium

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-17924

CWE-ID: CWE-306

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
1756-EN3TR Series B
Client/Desktop applications / Software for system administration
1756-EN3TR Series A
Client/Desktop applications / Software for system administration
1756-EN2TR Series C
Client/Desktop applications / Software for system administration
1756-EN2TR Series B
Client/Desktop applications / Software for system administration
1756-EN2TR Series A
Client/Desktop applications / Software for system administration
1756-EN2T Series D
Client/Desktop applications / Software for system administration
1756-EN2T Series C
Client/Desktop applications / Software for system administration
1756-EN2T Series B
Client/Desktop applications / Software for system administration
1756-EN2T Series A
Client/Desktop applications / Software for system administration
1756-EN2F Series C
Client/Desktop applications / Software for system administration
1756-EN2F Series B
Client/Desktop applications / Software for system administration
1756-EN2F Series A
Client/Desktop applications / Software for system administration
1756-EWEB Series B
Client/Desktop applications / Software for system administration
1756-EWEB Series A
Client/Desktop applications / Software for system administration
1756-ENBT
Client/Desktop applications / Software for system administration
MicroLogix 1400 Controller Series C
Client/Desktop applications / Software for system administration
MicroLogix 1400 Controllers Series B
Client/Desktop applications / Software for system administration
MicroLogix 1400 Controllers Series A
Client/Desktop applications / Software for system administration

Vendor: Rockwell Automation

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The vulnerability exists due to a loss of communication between the device and the rest of the system when the affected device accepts this new IP configuration as the system traffic is still attempting to communicate with the device via the overwritten IP address.. A remote attacker can send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode.

Mitigation
Install update from vendor's website.

Vulnerable software versions

1756-EN3TR Series B: All versions

1756-EN3TR Series A: All versions

1756-EN2TR Series C: All versions

1756-EN2TR Series B: All versions

1756-EN2TR Series A: All versions

1756-EN2T Series D: All versions

1756-EN2T Series C: All versions

1756-EN2T Series B: All versions

1756-EN2T Series A: All versions

1756-EN2F Series C: All versions

1756-EN2F Series B: All versions

1756-EN2F Series A: All versions

1756-EWEB Series B: All versions

1756-EWEB Series A: All versions

1756-ENBT: All versions

MicroLogix 1400 Controller Series C: All versions

MicroLogix 1400 Controllers Series B: All versions

MicroLogix 1400 Controllers Series A: All versions

---

External links
http://ics-cert.us-cert.gov/advisories/ICSA-18-310-02

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.