CVSS: 8.6EPSS: 0%CPEs: 2EXPL: 0CVE-2021-22659
https://notcve.org/view.php?id=CVE-2021-22659
Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user. Rockwell Automation MicroLogix 1400 versión 21.6 y anteriores, puede permitir a un atacante remoto no autenticado enviar un paquete Modbus especialmente diseñado que le permita al atacante recuperar o modificar valores aleatorios en el registro. • https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1129877/loc/en_US#__highlight https://us-cert.cisa.gov/ics/advisories/icsa-21-033-01 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2020-6111
https://notcve.org/view.php?id=CVE-2020-6111
An exploitable denial-of-service vulnerability exists in the IPv4 functionality of Allen-Bradley MicroLogix 1100 Programmable Logic Controller Systems Series B FRN 16.000, Series B FRN 15.002, Series B FRN 15.000, Series B FRN 14.000, Series B FRN 13.000, Series B FRN 12.000, Series B FRN 11.000 and Series B FRN 10.000. A specially crafted packet can cause a major error, resulting in a denial of service. An attacker can send a malicious packet to trigger this vulnerability. Se presenta una vulnerabilidad explotable de denegación de servicio en la funcionalidad IPv4 de Allen-Bradley MicroLogix 1100 Programmable Logic Controller Systems Series B FRN 16.000, Series B FRN 15.002, Series B FRN 15.000, Series B FRN 14.000, Series B FRN 13.000, Series B FRN 12.000, Series B FRN 11.000 y Series B FRN 10.000. Un paquete especialmente diseñado puede causar un error importante, resultando en una denegación de servicio. • https://talosintelligence.com/vulnerability_reports/TALOS-2020-1057 https://us-cert.cisa.gov/ics/advisories/icsa-21-047-02 • CWE-189: Numeric Errors •
CVSS: 7.5EPSS: 1%CPEs: 6EXPL: 0CVE-2020-6984
https://notcve.org/view.php?id=CVE-2020-6984
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic function utilized to protect the password in MicroLogix is discoverable. Rockwell Automation MicroLogix 1400 Controllers Series B versiones v21.001 y anteriores, Series A, todas las versiones, MicroLogix 1100 Controller, todas las versiones, RSLogix 500 Software versiones v12.001 y anteriores. La función criptográfica usada para proteger la contraseña en MicroLogix es detectable. • https://www.us-cert.gov/ics/advisories/icsa-20-070-06 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 10.0EPSS: 2%CPEs: 6EXPL: 0CVE-2020-6990
https://notcve.org/view.php?id=CVE-2020-6990
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic key utilized to help protect the account password is hard coded into the RSLogix 500 binary file. An attacker could identify cryptographic keys and use it for further cryptographic attacks that could ultimately lead to a remote attacker gaining unauthorized access to the controller. Rockwell Automation MicroLogix 1400 Controllers Series B versiones v21.001 y anteriores, Series A, todas las versiones, MicroLogix 1100 Controller, todas las versiones, RSLogix 500 Software versiones v12.001 y anteriores; La clave criptográfica usada para ayudar a proteger la contraseña de cuenta está embebida en el archivo binario de RSLogix 500. Un atacante podría identificar claves criptográficas y usarlas para nuevos ataques criptográficos que finalmente podrían conllevar a que un atacante remoto consiga acceso no autorizado al controlador. • https://www.us-cert.gov/ics/advisories/icsa-20-070-06 • CWE-321: Use of Hard-coded Cryptographic Key CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2020-6988
https://notcve.org/view.php?id=CVE-2020-6988
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, A remote, unauthenticated attacker can send a request from the RSLogix 500 software to the victim’s MicroLogix controller. The controller will then respond to the client with used password values to authenticate the user on the client-side. This method of authentication may allow an attacker to bypass authentication altogether, disclose sensitive information, or leak credentials. Rockwell Automation MicroLogix 1400 Controllers Series B versiones v21.001 y anteriores, Series A, todas las versiones, MicroLogix 1100 Controller, todas las versiones, RSLogix 500 Software versiones v12.001 y anteriores, un atacante no autenticado remoto puede enviar una petición desde el software RSLogix 500 hacia el controlador MicroLogix de la víctima. El controlador responderá al cliente con los valores de contraseña usados para autenticar al usuario en el lado del cliente. • https://www.us-cert.gov/ics/advisories/icsa-20-070-06 • CWE-287: Improper Authentication CWE-603: Use of Client-Side Authentication •