Cisco Talos has detailed several vulnerabilities found in four Rockwell Automation Allen-Bradley MicroLogix 1400 Programmable Logic Controllers that are used in conjunction with industrial control systems.
Talos details vulnerabilities in Allen-Bradley MicroLogix 1400 Programmable Logic Controllers.
Cisco Talos has detailed several vulnerabilities found in four Rockwell Automation Allen-Bradley MicroLogix 1400 Programmable Logic Controllers that are used in conjunction with industrial control systems.
The products in question are all variants of the Allen-Bradley Micrologix 1400 Series B and, according to Talos, are intended to be used with a variety of industrial control systems handling critical infrastructure. The vulnerabilities spanned four variants of the Allen-Bradley Micrologix 1400, the:
- Series B FRN 21.003
- Series B FRN 21.002
- Series B FRN 21.0
- Series B FRN 15
The vulnerabilities are covered under seven CVEs (CVE-2017-12088, CVE-2017-12089, CVE-2017-12090, CVE-2017-14462, CVE-2017-14473, CVE-2017-12092, CVE-2017-12093) which if left unpatched could result in a variety of problems. These include, being able to modify device configuration and ladder logic, write modified program data into the device’s memory module, erase program data from the device’s memory module, or conduct Denial of Service (DoS) attacks against affected devices.
“As these devices are often deployed to support critical industrial control processes, it is recommended that organisations making use of affected devices upgrade to the latest version of firmware so that devices are no longer affected by these vulnerabilities,” the Talos report stated.
SC Media has emailed Rockwell Automation for commentary on the story.
Source: https://www.scmagazineuk.com/talos-details-vulnerabilities-in-allen-bradley-programmable-controllers/article/755733/
