The vulnerability of the microprogramming software used in MicroLogix 1400 A, MicroLogix 1400 B, MicroLogix 1100, CompactLogix 5370 L1, CompactLogix 5370 L2, and CompactLogix 5370 L3 allows a hacker to redirect the target user to a malicious website using a specially created link.

🗓️ 26 Dec 2019 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Vulnerability in MicroLogix and CompactLogix enables redirecting users to malicious sites via crafted links.

Reporter	Title	Published	Views	Family All 13
Tenable Nessus	Rockwell Automation MicroLogix and CompactLogix Multiple Controllers Open Redirect	8 May 201900:00	–	nessus
Tenable Nessus	Rockwellautomation Micrologix URL Redirection to Untrusted Site ('Open Redirect')	8 Nov 201900:00	–	nessus
Tenable Nessus	Rockwell Automation MicroLogix 1100/1400 and CompactLogix 5370 Controllers Open Redirection Vulnerability	21 May 201900:00	–	nessus
Tenable Nessus	Rockwell Automation MicroLogix 1400 and CompactLogix 5370 Controllers URL Redirection to Untrusted Site (CVE-2019-10955)	7 Feb 202200:00	–	nessus
CNVD	Multiple Rockwell Automation Products Input Validation Error Vulnerability	25 Apr 201900:00	–	cnvd
Check Point Advisories	Rockwell Automation Multiple Controllers Open Redirect (CVE-2019-10955)	28 Apr 201900:00	–	checkpoint_advisories
CVE	CVE-2019-10955	25 Apr 201917:27	–	cve
Cvelist	CVE-2019-10955	25 Apr 201917:27	–	cvelist
EUVD	EUVD-2019-2669	7 Oct 202500:30	–	euvd
ICS	Rockwell Automation MicroLogix 1400 and CompactLogix 5370 Controllers	23 Apr 201900:00	–	ics

Vulners

Node

rockwell_automation micrologix_1400_bRange≤15.002

OR

rockwell_automation micrologix_1100Range≤14.00

OR

rockwell_automation compactlogix_5370_l1Range≤30.014

OR

rockwell_automation compactlogix_5370_l2Range≤30.014

OR

rockwell_automation compactlogix_5370_l3Range≤30.014

Source	Link
securitylab	www.securitylab.ru/news/498933.php
rockwellautomation	www.rockwellautomation.custhelp.com/app/answers/detail/a_id/1086288
us-cert	www.us-cert.gov/ics/advisories/ICSA-19-113-01
nvd	www.nvd.nist.gov/vuln/detail/CVE-2019-10955
web	www.web.nvd.nist.gov/view/vuln/detail

26 Dec 2019 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 36.1

CVSS 26.4

EPSS0.0293

MicroLogix CompactLogix microprogramming software malicious websites crafted links