CVE-2014-5410

Vulnerability

The DNP3 feature implementation in Rockwell Automation Allen-Bradley MicroLogix 1400 controllers contains an improper input validation vulnerability (CWE-20). Affected versions include 1766-Lxxxxx Series A FRN 7 and earlier, and 1766-Lxxxxx Series B FRN 15.000 and earlier [1][2]. The vulnerability is present in the DNP3 application layer, which is accessible over Ethernet or serial communication lines.

Exploitation

An attacker can exploit this vulnerability remotely by sending specially crafted, malformed DNP3 packets to the target controller over an Ethernet network or a serial line [1][2]. No authentication is required, and the attacker only needs network connectivity to the device. The malformed packets trigger a flaw in input validation within the DNP3 protocol handler.

Impact

Successful exploitation causes a disruption of the DNP3 application layer process, leading to a denial-of-service (DoS) condition [1][2]. This results in a loss of product communication and network availability. The controller is unable to resume normal operation until a manual power cycle is performed, causing an interruption in industrial control processes [1][2].

Mitigation

Rockwell Automation has released a firmware revision to mitigate this vulnerability. Users should update Series A controllers to a version after FRN 7, and Series B controllers to FRN 15.001 or later [1][2]. As a best practice, ICS-CERT recommends that organizations isolate control system networks from untrusted networks and restrict network access to affected devices [1][2].