Sign-up

ID

VAR-201510-0199


CVE

CVE-2015-6491


TITLE

Allen-Bradley MicroLogix Arbitrary file insertion vulnerability

Trust: 0.8

sources: IVD: 7c716140-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07305

DESCRIPTION

Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via unspecified vectors. Allen-Bradley MicroLogix 1100 and 1400 The device includes FRAME A vulnerability exists in which the contents of an arbitrary file are inserted into an element. Supplementary information : CWE Vulnerability type by CWE-434: Unrestricted Upload of File with Dangerous Type ( Unlimited upload of dangerous types of files ) Has been identified. http://cwe.mitre.org/data/definitions/434.htmlBy a remotely authenticated user FRAME Any file content may be inserted into the element. The Allen-Bradley MicroLogix 1100 has a file insertion vulnerability in versions prior to B FRN 15.000 and versions prior to 1400 in B FRN 15.003. Rockwell Automation 1766-L32 Series is a 1766-L32 series programmable logic controller (PLC) from Rockwell Automation. A remote file inclusion vulnerability exists in the Rockwell Automation 1766-L32 Series product, which is caused by the program's insufficient filtering of user-submitted input. An attacker could use this vulnerability to obtain sensitive information or execute arbitrary script code in the context of a Web process to control the application. This may allow the attacker to compromise the application; other attacks are also possible

Trust: 3.24

sources: NVD: CVE-2015-6491 // JVNDB: JVNDB-2015-005656 // CNVD: CNVD-2015-07305 // CNNVD: CNNVD-201508-365 // BID: 76357 // IVD: 7c716140-2351-11e6-abef-000c29c66e3d // VULHUB: VHN-84452

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 7c716140-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07305

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:micrologix 1100scope:lteversion:14.000

Trust: 1.0

vendor:rockwellautomationmodel:micrologix 1400scope:lteversion:15.002

Trust: 1.0

vendor:rockwell automationmodel:micrologix 1100scope:ltversion:b frn 15.000

Trust: 0.8

vendor:rockwell automationmodel:micrologix 1400scope:ltversion:b frn 15.003

Trust: 0.8

vendor:rockwellmodel:automation micrologixscope:eqversion:1100

Trust: 0.6

vendor:rockwellmodel:automation micrologixscope:eqversion:1400

Trust: 0.6

vendor:rockwellautomationmodel:micrologix 1100scope:eqversion:14.000

Trust: 0.6

vendor:rockwellautomationmodel:micrologix 1400scope:eqversion:15.002

Trust: 0.6

vendor:micrologix 1100model: - scope:eqversion:*

Trust: 0.2

vendor:micrologix 1400model: - scope:eqversion:*

Trust: 0.2

sources: IVD: 7c716140-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07305 // JVNDB: JVNDB-2015-005656 // CNNVD: CNNVD-201510-675 // NVD: CVE-2015-6491

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-6491
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-6491
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2015-07305
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201510-675
value: MEDIUM

Trust: 0.6

IVD: 7c716140-2351-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

VULHUB: VHN-84452
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-6491
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-07305
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 7c716140-2351-11e6-abef-000c29c66e3d
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-84452
severity: MEDIUM
baseScore: 4.0
vectorString: AV:N/AC:L/AU:S/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: IVD: 7c716140-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-07305 // VULHUB: VHN-84452 // JVNDB: JVNDB-2015-005656 // CNNVD: CNNVD-201510-675 // NVD: CVE-2015-6491

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

problemtype:CWE-Other

Trust: 0.8

sources: JVNDB: JVNDB-2015-005656 // NVD: CVE-2015-6491

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201508-365 // CNNVD: CNNVD-201510-675

TYPE

other

Trust: 0.8

sources: IVD: 7c716140-2351-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201510-675

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-005656

PATCH
title:MicroLogixシステムurl:http://ab.rockwellautomation.com/ja/Programmable-Controllers/MicroLogix-Systems
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2015-005656

EXTERNAL IDS
db:NVDid:CVE-2015-6491
Trust: 3.6
db:ICS CERTid:ICSA-15-300-03
Trust: 3.1
db:BIDid:76357
Trust: 1.0
db:CNNVDid:CNNVD-201510-675
Trust: 0.9
db:CNVDid:CNVD-2015-07305
Trust: 0.8
db:JVNDBid:JVNDB-2015-005656
Trust: 0.8
db:CNNVDid:CNNVD-201508-365
Trust: 0.6
db:IVDid:7C716140-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULHUBid:VHN-84452
Trust: 0.1
sources:
            
            
            IVD: 7c716140-2351-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2015-07305 // 
            
            
            
            VULHUB: VHN-84452 // 
            
            
            
            BID: 76357 // 
            
            
            
            JVNDB: JVNDB-2015-005656 // 
            
            
            
            CNNVD: CNNVD-201508-365 // 
            
            
            
            CNNVD: CNNVD-201510-675 // 
            
            
            
            NVD: CVE-2015-6491

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-15-300-03
Trust: 3.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6491
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-6491
Trust: 0.8
url:http://www.securityfocus.com/bid/76357
Trust: 0.6
url:http://www.rockwellautomation.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2015-07305 // 
            
            
            
            VULHUB: VHN-84452 // 
            
            
            
            BID: 76357 // 
            
            
            
            JVNDB: JVNDB-2015-005656 // 
            
            
            
            CNNVD: CNNVD-201508-365 // 
            
            
            
            CNNVD: CNNVD-201510-675 // 
            
            
            
            NVD: CVE-2015-6491

CREDITS
ICS-CERT
Trust: 0.9
sources:
            
            
            BID: 76357 // 
            
            
            
            CNNVD: CNNVD-201508-365

SOURCES
db:IVDid:7c716140-2351-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2015-07305
db:VULHUBid:VHN-84452
db:BIDid:76357
db:JVNDBid:JVNDB-2015-005656
db:CNNVDid:CNNVD-201508-365
db:CNNVDid:CNNVD-201510-675
db:NVDid:CVE-2015-6491

LAST UPDATE DATE
2025-04-13T23:09:46.458000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-07305date:2015-11-05T00:00:00
db:VULHUBid:VHN-84452date:2015-10-28T00:00:00
db:BIDid:76357date:2015-12-08T22:02:00
db:JVNDBid:JVNDB-2015-005656date:2015-10-29T00:00:00
db:CNNVDid:CNNVD-201508-365date:2015-08-19T00:00:00
db:CNNVDid:CNNVD-201510-675date:2015-10-29T00:00:00
db:NVDid:CVE-2015-6491date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:IVDid:7c716140-2351-11e6-abef-000c29c66e3ddate:2015-11-05T00:00:00
db:CNVDid:CNVD-2015-07305date:2015-11-05T00:00:00
db:VULHUBid:VHN-84452date:2015-10-28T00:00:00
db:BIDid:76357date:2015-08-13T00:00:00
db:JVNDBid:JVNDB-2015-005656date:2015-10-29T00:00:00
db:CNNVDid:CNNVD-201508-365date:2015-08-19T00:00:00
db:CNNVDid:CNNVD-201510-675date:2015-10-29T00:00:00
db:NVDid:CVE-2015-6491date:2015-10-28T10:59:13.887