Vulnerability identifier: #VU81050
Vulnerability risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-121
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
1756-EN2T Series A
Client/Desktop applications /
Software for system administration
1756-EN2T Series B
Client/Desktop applications /
Software for system administration
1756-EN2T Series C
Client/Desktop applications /
Software for system administration
1756-EN2T Series D
Client/Desktop applications /
Software for system administration
1756-EN2TR Series A
Client/Desktop applications /
Software for system administration
1756-EN2TR Series B
Client/Desktop applications /
Software for system administration
1756-EN2TR Series C
Client/Desktop applications /
Software for system administration
1756-EN2TRXT Series B
Client/Desktop applications /
Software for system administration
1756-EN2F Series A
Client/Desktop applications /
Software for system administration
1756-EN2F Series B
Client/Desktop applications /
Software for system administration
1756-EN2F Series C
Client/Desktop applications /
Software for system administration
1756-EN2FK Series B
Client/Desktop applications /
Software for system administration
1756-EN3TR Series A
Client/Desktop applications /
Software for system administration
1756-EN3TR Series B
Client/Desktop applications /
Software for system administration
1756-EN2TK Series A
Server applications /
SCADA systems
1756-EN2TK Series B
Server applications /
SCADA systems
1756-EN2TK Series C
Server applications /
SCADA systems
1756-EN2TK Series D
Server applications /
SCADA systems
1756-EN2TXT Series A
Server applications /
SCADA systems
1756-EN2TXT Series B
Server applications /
SCADA systems
1756-EN2TXT Series C
Server applications /
SCADA systems
1756-EN2TXT Series D
Server applications /
SCADA systems
1756-EN2TP Series A
Server applications /
SCADA systems
1756-EN2TPK Series A
Server applications /
SCADA systems
1756-EN2TPXT Series A
Server applications /
SCADA systems
1756-EN2TRK Series A
Server applications /
SCADA systems
1756-EN2TRK Series B
Server applications /
SCADA systems
1756-EN2TRK Series C
Server applications /
SCADA systems
1756-EN2TRXT Series A
Server applications /
SCADA systems
1756-EN2TRXT Series C
Server applications /
SCADA systems
1756-EN2FK Series A
Server applications /
SCADA systems
1756-EN2FK Series C
Server applications /
SCADA systems
1756-EN3TRK Series A
Server applications /
SCADA systems
1756-EN3TRK Series B
Server applications /
SCADA systems
Vendor: Rockwell Automation
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote unauthenticated attacker can send a specially crafted CIP request, trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
1756-EN2T Series A: 5.008 - 5.028
1756-EN2T Series B: 5.008 - 5.028
1756-EN2T Series C: 5.008 - 5.028
1756-EN2T Series D: 11.002
1756-EN2TK Series A: 5.008 - 5.028
1756-EN2TK Series B: 5.008 - 5.028
1756-EN2TK Series C: 5.008 - 5.028
1756-EN2TK Series D: 11.002
1756-EN2TXT Series A: 5.008 - 5.028
1756-EN2TXT Series B: 5.008 - 5.028
1756-EN2TXT Series C: 5.008 - 5.028
1756-EN2TXT Series D: 11.002
1756-EN2TP Series A: 11.002
1756-EN2TPK Series A: 11.002
1756-EN2TPXT Series A: 11.002
1756-EN2TR Series A: 5.008 - 5.028
1756-EN2TR Series B: 5.008 - 5.028
1756-EN2TR Series C: 11.002
1756-EN2TRK Series A: 5.008 - 5.028
1756-EN2TRK Series B: 5.008 - 5.028
1756-EN2TRK Series C: 11.002
1756-EN2TRXT Series A: 5.008 - 5.028
1756-EN2TRXT Series B: 5.008 - 5.028
1756-EN2TRXT Series C: 11.002
1756-EN2F Series A: 5.008 - 5.028
1756-EN2F Series B: 5.008 - 5.028
1756-EN2F Series C: 11.002
1756-EN2FK Series A: 5.008 - 5.028
1756-EN2FK Series B: 5.008 - 5.028
1756-EN2FK Series C: 11.002
1756-EN3TR Series A: 5.008 - 5.028
1756-EN3TR Series B: 11.002
1756-EN3TRK Series A: 5.008 - 5.028
1756-EN3TRK Series B: 11.002
External links
http://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140786
http://www.cisa.gov/news-events/ics-advisories/icsa-23-264-04
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.