Sign-up

ID

VAR-201804-0373


CVE

CVE-2017-14462


TITLE

Allen Bradley Micrologix 1400 Series Access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-013212

DESCRIPTION

An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially crafted packet can cause a read or write operation resulting in disclosure of sensitive information, modification of settings, or modification of ladder logic. An attacker can send unauthenticated packets to trigger this vulnerability. Required Keyswitch State: REMOTE or PROG (also RUN for some) Description: Allows an attacker to enable SNMP, Modbus, DNP, and any other features in the channel configuration. Also allows attackers to change network parameters, such as IP address, name server, and domain name. The AllenBradley Micrologix 1400 SeriesBFRN is a programmable logic controller from Rockwell Automation

Trust: 2.43

sources: NVD: CVE-2017-14462 // JVNDB: JVNDB-2017-013212 // CNVD: CNVD-2018-08275 // IVD: e2ec5241-39ab-11e9-9046-000c29342cb1 // VULHUB: VHN-105187

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

sources: IVD: e2ec5241-39ab-11e9-9046-000c29342cb1 // CNVD: CNVD-2018-08275

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:micrologix 1400 bscope:lteversion:21.2

Trust: 1.0

vendor:rockwell automationmodel:micrologix 1400scope:lteversion:b frn 21.2

Trust: 0.8

vendor:rockwellmodel:automation allen bradley micrologix series b frnscope:eqversion:1400<=21.2

Trust: 0.6

vendor:rockwellautomationmodel:micrologix 1400 bscope:eqversion:21.2

Trust: 0.6

vendor:micrologix 1400 bmodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: e2ec5241-39ab-11e9-9046-000c29342cb1 // CNVD: CNVD-2018-08275 // JVNDB: JVNDB-2017-013212 // CNNVD: CNNVD-201709-559 // NVD: CVE-2017-14462

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-14462
value: CRITICAL

Trust: 1.0

talos-cna@cisco.com: CVE-2017-14462
value: CRITICAL

Trust: 1.0

NVD: CVE-2017-14462
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2018-08275
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201709-559
value: CRITICAL

Trust: 0.6

IVD: e2ec5241-39ab-11e9-9046-000c29342cb1
value: CRITICAL

Trust: 0.2

VULHUB: VHN-105187
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-14462
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-08275
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e2ec5241-39ab-11e9-9046-000c29342cb1
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-105187
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-14462
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

talos-cna@cisco.com: CVE-2017-14462
baseSeverity: CRITICAL
baseScore: 10.0
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 6.0
version: 3.0

Trust: 1.0

NVD: CVE-2017-14462
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: e2ec5241-39ab-11e9-9046-000c29342cb1 // CNVD: CNVD-2018-08275 // VULHUB: VHN-105187 // JVNDB: JVNDB-2017-013212 // CNNVD: CNNVD-201709-559 // NVD: CVE-2017-14462 // NVD: CVE-2017-14462

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-284

Trust: 0.9

sources: VULHUB: VHN-105187 // JVNDB: JVNDB-2017-013212 // NVD: CVE-2017-14462

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201709-559

TYPE

Access control error

Trust: 0.8

sources: IVD: e2ec5241-39ab-11e9-9046-000c29342cb1 // CNNVD: CNNVD-201709-559

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-013212

PATCH
title:MicroLogix 1400 プログラマブル・ロジック・コントローラ・システムurl:https://ab.rockwellautomation.com/ja/Programmable-Controllers/MicroLogix-1400
Trust: 0.8
title:Patch for AllenBradleyMicrologix1400SeriesBFRN Access Control Vulnerability (CNVD-2018-08275)url:https://www.cnvd.org.cn/patchInfo/show/126967
Trust: 0.6
title:Rockwell Automation Allen Bradley Micrologix 1400 Series B Fixes for access control error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=100045
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-08275 // 
            
            
            
            JVNDB: JVNDB-2017-013212 // 
            
            
            
            CNNVD: CNNVD-201709-559

EXTERNAL IDS
db:NVDid:CVE-2017-14462
Trust: 3.3
db:TALOSid:TALOS-2017-0443
Trust: 3.1
db:CNNVDid:CNNVD-201709-559
Trust: 0.9
db:CNVDid:CNVD-2018-08275
Trust: 0.8
db:JVNDBid:JVNDB-2017-013212
Trust: 0.8
db:IVDid:E2EC5241-39AB-11E9-9046-000C29342CB1
Trust: 0.2
db:VULHUBid:VHN-105187
Trust: 0.1
sources:
            
            
            IVD: e2ec5241-39ab-11e9-9046-000c29342cb1 // 
            
            
            
            CNVD: CNVD-2018-08275 // 
            
            
            
            VULHUB: VHN-105187 // 
            
            
            
            JVNDB: JVNDB-2017-013212 // 
            
            
            
            CNNVD: CNNVD-201709-559 // 
            
            
            
            NVD: CVE-2017-14462

REFERENCES
url:https://www.talosintelligence.com/vulnerability_reports/talos-2017-0443
Trust: 3.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-14462
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2017-14462
Trust: 0.8
url:https://talosintelligence.com/vulnerability_reports/talos-2017-0443
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2018-08275 // 
            
            
            
            VULHUB: VHN-105187 // 
            
            
            
            JVNDB: JVNDB-2017-013212 // 
            
            
            
            CNNVD: CNNVD-201709-559 // 
            
            
            
            NVD: CVE-2017-14462

SOURCES
db:IVDid:e2ec5241-39ab-11e9-9046-000c29342cb1
db:CNVDid:CNVD-2018-08275
db:VULHUBid:VHN-105187
db:JVNDBid:JVNDB-2017-013212
db:CNNVDid:CNNVD-201709-559
db:NVDid:CVE-2017-14462

LAST UPDATE DATE
2024-11-23T21:39:27.782000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-08275date:2018-04-25T00:00:00
db:VULHUBid:VHN-105187date:2022-12-14T00:00:00
db:JVNDBid:JVNDB-2017-013212date:2018-06-06T00:00:00
db:CNNVDid:CNNVD-201709-559date:2022-04-20T00:00:00
db:NVDid:CVE-2017-14462date:2024-11-21T03:12:50.577

SOURCES RELEASE DATE
db:IVDid:e2ec5241-39ab-11e9-9046-000c29342cb1date:2018-04-25T00:00:00
db:CNVDid:CNVD-2018-08275date:2018-04-25T00:00:00
db:VULHUBid:VHN-105187date:2018-04-05T00:00:00
db:JVNDBid:JVNDB-2017-013212date:2018-06-06T00:00:00
db:CNNVDid:CNNVD-201709-559date:2017-09-14T00:00:00
db:NVDid:CVE-2017-14462date:2018-04-05T21:29:00.507