Lucene search

RockwellCVE-2022-46670

HistoryDec 16, 2022 - 9:15 p.m.

CVE-2022-46670

2022-12-1621:15:09

CWE-79

Rockwell

web.nvd.nist.gov

cve-2022-46670

rockwell automation

micrologix

vulnerability

remote code execution

unauthenticated

cross-site scripting

snmp

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

26.8%

JSON

Rockwell Automation was made aware of a vulnerability by a security researcher from Georgia Institute of Technology that the MicroLogix 1100 and 1400 controllers contain a vulnerability that may give an attacker the ability to accomplish remote code execution. The vulnerability is an unauthenticated stored cross-site scripting vulnerability in the embedded webserver. The payload is transferred to the controller over SNMP and is rendered on the homepage of the embedded website.

Affected configurations

Nvd

Node

rockwellautomationmicrologix_1400_firmwareMatch-

AND

rockwellautomationmicrologix_1400Match-

Node

rockwellautomationmicrologix_1100_firmwareMatch-

AND

rockwellautomationmicrologix_1100Match-

Node

rockwellautomationmicrologix_1400-b_firmwareRange≤21.007

AND

rockwellautomationmicrologix_1400-bMatch-

Node

rockwellautomationmicrologix_1400-c_firmwareRange≤21.007

AND

rockwellautomationmicrologix_1400-cMatch-

Node

rockwellautomationmicrologix_1400-a_firmwareRange≤7.000

AND

rockwellautomationmicrologix_1400-aMatch-

VendorProductVersionCPE
rockwellautomationmicrologix_1400_firmware-cpe:2.3:o:rockwellautomation:micrologix_1400_firmware:-:*:*:*:*:*:*:*
rockwellautomationmicrologix_1400-cpe:2.3:h:rockwellautomation:micrologix_1400:-:*:*:*:*:*:*:*
rockwellautomationmicrologix_1100_firmware-cpe:2.3:o:rockwellautomation:micrologix_1100_firmware:-:*:*:*:*:*:*:*
rockwellautomationmicrologix_1100-cpe:2.3:h:rockwellautomation:micrologix_1100:-:*:*:*:*:*:*:*
rockwellautomationmicrologix_1400-b_firmware*cpe:2.3:o:rockwellautomation:micrologix_1400-b_firmware:*:*:*:*:*:*:*:*
rockwellautomationmicrologix_1400-b-cpe:2.3:h:rockwellautomation:micrologix_1400-b:-:*:*:*:*:*:*:*
rockwellautomationmicrologix_1400-c_firmware*cpe:2.3:o:rockwellautomation:micrologix_1400-c_firmware:*:*:*:*:*:*:*:*
rockwellautomationmicrologix_1400-c-cpe:2.3:h:rockwellautomation:micrologix_1400-c:-:*:*:*:*:*:*:*
rockwellautomationmicrologix_1400-a_firmware*cpe:2.3:o:rockwellautomation:micrologix_1400-a_firmware:*:*:*:*:*:*:*:*
rockwellautomationmicrologix_1400-a-cpe:2.3:h:rockwellautomation:micrologix_1400-a:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rockwellautomation	micrologix_1400_firmware	-	cpe:2.3:o:rockwellautomation:micrologix_1400_firmware:-:::::::*
rockwellautomation	micrologix_1400	-	cpe:2.3:h:rockwellautomation:micrologix_1400:-:::::::*
rockwellautomation	micrologix_1100_firmware	-	cpe:2.3:o:rockwellautomation:micrologix_1100_firmware:-:::::::*
rockwellautomation	micrologix_1100	-	cpe:2.3:h:rockwellautomation:micrologix_1100:-:::::::*
rockwellautomation	micrologix_1400-b_firmware	*	cpe:2.3:o:rockwellautomation:micrologix_1400-b_firmware::::::::
rockwellautomation	micrologix_1400-b	-	cpe:2.3:h:rockwellautomation:micrologix_1400-b:-:::::::*
rockwellautomation	micrologix_1400-c_firmware	*	cpe:2.3:o:rockwellautomation:micrologix_1400-c_firmware::::::::
rockwellautomation	micrologix_1400-c	-	cpe:2.3:h:rockwellautomation:micrologix_1400-c:-:::::::*
rockwellautomation	micrologix_1400-a_firmware	*	cpe:2.3:o:rockwellautomation:micrologix_1400-a_firmware::::::::
rockwellautomation	micrologix_1400-a	-	cpe:2.3:h:rockwellautomation:micrologix_1400-a:-:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "MicroLogix 1100 & 1400 Controllers",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "All"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "MicroLogix 1400-B/C",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "21.007 and below"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "MicroLogix 1400-A",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "7.000 and below"
      }
    ]
  }
]

References

rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137679

CVSS3

7.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

AI Score

6.5

Confidence

High

EPSS

0.001

Percentile

26.8%

JSON

Related for CVE-2022-46670