Rockwell Automation MicroLogix Controllers and RSLogix 500 Software

🗓️ 10 Mar 2020 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics

ics🔗 www.cisa.gov👁 77 Views

Rockwell Automation MicroLogix and RSLogix 500 security vulnerabilitie

Reporter	Title	Published	Views	Family All 49
BDU FSTEC	The vulnerability of the RSLogix 500 software, the programmable logic controllers MicroLogix 1100 and MicroLogix 1400, arises from the use of a rigidly encrypted cryptographic key, which allows an intruder to gain enhanced privileges.	12 Mar 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the cryptographic function used to protect passwords, the RSLogix 500 software, and the programmable logic controllers MicroLogix 1100 and MicroLogix 1400, allows unauthorized access to confidential information.	13 Mar 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the RSLogix 500 software, the programmable logic controllers MicroLogix 1100 and MicroLogix 1400, allows a intruder to disclose confidential information.	13 Mar 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Simple Mail Transfer Protocol (SMTP) software of RSLogix 500, as well as the programmable logic controllers MicroLogix 1100 and MicroLogix 1400, allows a intruder to gain unauthorized access to confidential information.	13 Mar 202000:00	–	bdu_fstec
CNVD	Multiple Rockwell Automation Products Licensing Issues Vulnerabilities	11 Mar 202000:00	–	cnvd
CNVD	Information Disclosure Vulnerability in Multiple Rockwell Automation Products	11 Mar 202000:00	–	cnvd
CNVD	Multiple Rockwell Automation Products Trust Management Issue Vulnerabilities	11 Mar 202000:00	–	cnvd
CNVD	Multiple Rockwell Automation Products Encryption Issues Vulnerabilities	11 Mar 202000:00	–	cnvd
CVE	CVE-2020-6980	16 Mar 202015:36	–	cve
CVE	CVE-2020-6984	16 Mar 202015:41	–	cve

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-070-06.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-20-070-06
us-cert	www.us-cert.gov/ics/alerts/ICS-ALERT-10-301-01
us-cert	www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B

10 Mar 2020 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 210

CVSS 3.19.8

EPSS0.04226

SSVC

cvss 9.8 remote exploit hard-coded cryptographic key broken risky algorithm client-side authentication cleartext storage critical infrastructure worldwide deployment scadax security positive technologies mitigations series b controllers series a controllers rslogix 500 software