CVE-2017-12090

Vulnerability

The vulnerability resides in the SNMP-set processing of Allen Bradley Micrologix 1400 Series B programmable logic controllers running firmware versions FRN 21.2 and below. Setting the OID .1.3.6.1.4.1.95.2.3.1.1.1.1.0 to the integer 2 triggers an unscheduled device reboot, mimicking the initial step of a firmware update but without performing any flashing operations. This OID is normally used during legitimate firmware updates. Affected firmware versions include FRN 21.2, 21.0, and 15; versions 16.2 and below support both SNMPv1 and SNMPv2c, while version 21.0 and later only support SNMPv1 for this functionality [1].

Exploitation

An attacker must possess a privileged SNMP community string to send the malicious SNMP-set request. Notably, the backdoor community string 'wheel' (disclosed in CVE-2016-5645) can be used even if the administrator has changed the default 'private' string. The attacker sends a single SNMP packet (SNMPv1 or SNMPv2c depending on firmware) setting the target OID to 2. No additional authentication or user interaction is required beyond network access to the device [1].

Impact

Successful exploitation causes the device to immediately power cycle, resulting in a denial of service (downtime). The device reboots without loading new firmware, so it returns to normal operation after the reboot, but the interruption can disrupt industrial processes. No data confidentiality or integrity is compromised; only availability is affected [1].

Mitigation

As of the publication of the Talos advisory (2017-12-05), no firmware patch was available. Users should restrict SNMP access to trusted hosts via network segmentation and firewall rules, change community strings from defaults, and monitor for vendor updates from Rockwell Automation. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog [1].