CVE-2017-14469

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B…

Critical · published April 5, 2018

CVSS v3.0
10.0
EPSS
38%
Percentile
98.6
In the wild
Unconfirmed
What it is

🚨 A single crafted packet can turn your Allen Bradley Micrologix 1400 Series B into a playground for attackers! 🔥 Think of this vulnerability as a sneaky delivery guy who knows how to slip a forged package into a secure facility, granting access to sensitive blueprints and even the ability to change the entire layout! If exploited, an attacker could read sensitive information or even modify crucial settings and ladder logic. This could lead to operational chaos, unauthorized changes, and potentially devastating consequences for industrial operations!

Put simply

Think of this vulnerability as a sneaky delivery guy who knows how to slip a forged package into a secure facility, granting access to sensitive blueprints and even the ability to change the entire layout! This access control vulnerability allows attackers to send unauthenticated packets that trigger read or write operations due to improper file permissions in the Micrologix 1400 Series B, affecting versions FRN 21.2 and earlier.

What to do

If exploited, an attacker could read sensitive information or even modify crucial settings and ladder logic. This could lead to operational chaos, unauthorized changes, and potentially devastating consequences for industrial operations! To secure your devices, update to the latest firmware version beyond FRN 21.2 to address this access control flaw. Additionally, ensure proper network segmentation and monitoring to minimize the risk of unauthorized access. 🛡️ You've got this! Follow these steps, and you'll be a hero protecting your industrial control systems! 💪✨

The record
Technical detail
CVSS v3.0
10.0 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.37965 · 98.6th percentile
Published
2018-04-05T21:00Z
EPSS history
Timeline
  • 05 APR 21:00Z
    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B…
    cvelistv5