CVE-2017-14473

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B…

Critical · published April 5, 2018

CVSS v3.0
10.0
EPSS
38%
Percentile
98.6
In the wild
Unconfirmed
What it is

🚨 A crafty attacker can send a single packet and gain unauthorized access to sensitive data, all thanks to an exploit in Allen Bradley's Micrologix 1400 Series B! 🔥 Think of this vulnerability like a sneaky hacker slipping a forged entry pass into a secure facility — once inside, they can rummage through sensitive files and change critical settings without anyone noticing. An attacker could easily exploit this flaw, leading to the disclosure of sensitive information, unauthorized modifications to settings, or even tampering with the core ladder logic. This could disrupt operations and potentially lead to catastrophic consequences if the system is controlling essential processes.

Put simply

Think of this vulnerability like a sneaky hacker slipping a forged entry pass into a secure facility — once inside, they can rummage through sensitive files and change critical settings without anyone noticing. This access control vulnerability allows unauthenticated packets to manipulate file permissions, enabling read and write operations on critical program data, including sensitive ladder logic files.

What to do

An attacker could easily exploit this flaw, leading to the disclosure of sensitive information, unauthorized modifications to settings, or even tampering with the core ladder logic. This could disrupt operations and potentially lead to catastrophic consequences if the system is controlling essential processes. Immediately update your Allen Bradley Micrologix 1400 Series B to the latest firmware version beyond FRN 21.2. Ensure that proper network protections are in place, such as firewalls and packet filtering to mitigate unauthorized access. Conduct a security audit to identify any exposed devices. You've got this! Follow these steps and stay ahead of the game in securing your systems! 🛡️

The record
Technical detail
CVSS v3.0
10.0 · CRITICAL
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.37965 · 98.6th percentile
Published
2018-04-05T21:00Z
EPSS history
Timeline
  • 05 APR 21:00Z
    An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B…
    cvelistv5