CVE-2017-14470

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B…

Critical · published April 5, 2018

CVSS v3.0
10.0
EPSS
38%
Percentile
98.6
In the wild
Unconfirmed
What it is

🚨 An attacker can send unauthenticated packets to manipulate sensitive operations in Allen Bradley Micrologix 1400 Series B — it’s like leaving your factory’s control panel unlocked for anyone to fiddle with! 🔥 Think of this vulnerability like an unguarded control room where anyone can adjust the machinery's settings without needing a keycard. A crafty attacker could tamper with your settings or even access sensitive information, causing chaos in the process. This is absolutely devastating! An attacker could seize control by reading or writing sensitive data, modify crucial settings, or even alter ladder logic, which can lead to catastrophic failures in your automation processes. Imagine the turmoil if your assembly line starts running amok because someone changed its programming!

Put simply

Think of this vulnerability like an unguarded control room where anyone can adjust the machinery's settings without needing a keycard. A crafty attacker could tamper with your settings or even access sensitive information, causing chaos in the process. This access control vulnerability in Allen Bradley Micrologix 1400 Series B allows attackers to send specially crafted packets that trigger unauthorized read and write operations, leading to the disclosure of sensitive information and modifications to settings or logic.

What to do

This is absolutely devastating! An attacker could seize control by reading or writing sensitive data, modify crucial settings, or even alter ladder logic, which can lead to catastrophic failures in your automation processes. Imagine the turmoil if your assembly line starts running amok because someone changed its programming! Immediately review your PLC configuration and ensure that you are running version FRN 21.3 or later to patch this vulnerability. Limit network access to only trusted devices, and consider implementing additional network segmentation to enhance security. Don’t forget to monitor logs for any suspicious activity! You've got this! With proactive measures, you can secure your setup and keep those rogue packets at bay! 🛡️

The record
Technical detail
CVSS v3.0
10.0 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.37965 · 98.6th percentile
Published
2018-04-05T21:00Z
EPSS history
Timeline
  • 05 APR 21:00Z
    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B…
    cvelistv5