CVE-2020-6988

2020-03-1615:38:36

CWE-603

icscert

www.cve.org

AI Score

7.7

Confidence

High

EPSS

0.001

Percentile

46.8%

JSON

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, A remote, unauthenticated attacker can send a request from the RSLogix 500 software to the victim’s MicroLogix controller. The controller will then respond to the client with used password values to authenticate the user on the client-side. This method of authentication may allow an attacker to bypass authentication altogether, disclose sensitive information, or leak credentials.

CNA Affected

[
  {
    "product": "Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior"
      }
    ]
  }
]

References

www.us-cert.gov/ics/advisories/icsa-20-070-06