Sign-up

ID

VAR-202103-0433


CVE

CVE-2021-22659


TITLE

Rockwell Automation  Made  MicroLogix 1400  Buffer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-001018

DESCRIPTION

Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user. Rockwell Automation Provided by the company MicroLogix 1400 Received Modbus Buffer overflow vulnerability due to packet processing (CWE-120) Exists. As a result, a buffer overflow occurs, and FAULT LED Flashes red and communication may be lost.Service operation obstruction by a remote third party (DoS) You may be attacked. Micrologix 1400 is a programmable logic controller introduced by Rockwell Automation

Trust: 2.25

sources: NVD: CVE-2021-22659 // JVNDB: JVNDB-2021-001018 // CNVD: CNVD-2021-34433 // VULMON: CVE-2021-22659

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2021-34433

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:micrologix 1400scope:lteversion:21.6

Trust: 1.0

vendor:rockwell automationmodel:micrologixscope:eqversion: -

Trust: 0.8

vendor:rockwell automationmodel:micrologixscope:lteversion:1400 all series version 21.6 and earlier

Trust: 0.8

vendor:rockwellmodel:automation micrologixscope:eqversion:1400<=21.6

Trust: 0.6

sources: CNVD: CNVD-2021-34433 // JVNDB: JVNDB-2021-001018 // NVD: CVE-2021-22659

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-22659
value: HIGH

Trust: 1.0

IPA: JVNDB-2021-001018
value: HIGH

Trust: 0.8

CNVD: CNVD-2021-34433
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202102-213
value: HIGH

Trust: 0.6

VULMON: CVE-2021-22659
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-22659
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

CNVD: CNVD-2021-34433
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2021-22659
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 4.7
version: 3.1

Trust: 1.0

IPA: JVNDB-2021-001018
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2021-34433 // VULMON: CVE-2021-22659 // JVNDB: JVNDB-2021-001018 // CNNVD: CNNVD-202102-213 // NVD: CVE-2021-22659

PROBLEMTYPE DATA

problemtype:CWE-120

Trust: 1.0

problemtype:Classic buffer overflow (CWE-120) [IPA Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-001018 // NVD: CVE-2021-22659

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202102-213

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202102-213

PATCH

title:Rockwell Automation Security Advisory PN1545 ( Login required )url:https://rockwellautomation.custhelp.com/app/answers/detail/a_id/898270/page/1

Trust: 0.8

title:Patch for Rockwell Automation MicroLogix 1400 buffer overflow vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/264596

Trust: 0.6

title:Allen-Bradley Flex IO Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=140420

Trust: 0.6

sources: CNVD: CNVD-2021-34433 // JVNDB: JVNDB-2021-001018 // CNNVD: CNNVD-202102-213

EXTERNAL IDS

db:NVDid:CVE-2021-22659

Trust: 3.1

db:ICS CERTid:ICSA-21-033-01

Trust: 3.1

db:JVNid:JVNVU93359735

Trust: 0.8

db:JVNDBid:JVNDB-2021-001018

Trust: 0.8

db:CNVDid:CNVD-2021-34433

Trust: 0.6

db:AUSCERTid:ESB-2021.0383

Trust: 0.6

db:CNNVDid:CNNVD-202102-213

Trust: 0.6

db:VULMONid:CVE-2021-22659

Trust: 0.1

sources: CNVD: CNVD-2021-34433 // VULMON: CVE-2021-22659 // JVNDB: JVNDB-2021-001018 // CNNVD: CNNVD-202102-213 // NVD: CVE-2021-22659

REFERENCES

url:https://us-cert.cisa.gov/ics/advisories/icsa-21-033-01

Trust: 3.7

url:https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129877/loc/en_us#__highlight

Trust: 1.7

url:http://jvn.jp/cert/jvnvu93359735

Trust: 0.8

url:https://www.auscert.org.au/bulletins/esb-2021.0383/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/120.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: CNVD: CNVD-2021-34433 // VULMON: CVE-2021-22659 // JVNDB: JVNDB-2021-001018 // CNNVD: CNNVD-202102-213 // NVD: CVE-2021-22659

SOURCES

db:CNVDid:CNVD-2021-34433
db:VULMONid:CVE-2021-22659
db:JVNDBid:JVNDB-2021-001018
db:CNNVDid:CNNVD-202102-213
db:NVDid:CVE-2021-22659

LAST UPDATE DATE

2024-11-23T22:11:06.148000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2021-34433date:2021-05-14T00:00:00
db:VULMONid:CVE-2021-22659date:2021-03-31T00:00:00
db:JVNDBid:JVNDB-2021-001018date:2021-03-25T07:28:00
db:CNNVDid:CNNVD-202102-213date:2021-04-01T00:00:00
db:NVDid:CVE-2021-22659date:2024-11-21T05:50:25.370

SOURCES RELEASE DATE

db:CNVDid:CNVD-2021-34433date:2021-05-14T00:00:00
db:VULMONid:CVE-2021-22659date:2021-03-25T00:00:00
db:JVNDBid:JVNDB-2021-001018date:2021-02-04T00:00:00
db:CNNVDid:CNNVD-202102-213date:2021-02-02T00:00:00
db:NVDid:CVE-2021-22659date:2021-03-25T16:15:14.040