CVE-2017-14466

Vulnerability

An access control vulnerability exists in the file permissions of Allen Bradley Micrologix 1400 Series B firmware versions FRN 21.2 and before (including FRN 21.0 and FRN 15). The filetype 0x03 grants unauthenticated write access, allowing an attacker to overwrite the Master Password stored in that file. The vulnerability is reachable when the keyswitch is in the REMOTE or PROG state [1].

Exploitation

An attacker can send unauthenticated CIP encapsulated PCCC commands using write function codes (0xa7, 0xa9, 0xaa, 0xab) to filetype 0x03. No authentication or prior access is required. The attacker must have network connectivity to the PLC and the keyswitch must be in REMOTE or PROG position. The exploit consists of crafting a packet that writes a new value to the Master Password location [1].

Impact

Successful exploitation allows the attacker to overwrite the Master Password, leading to disclosure of sensitive information (the password), modification of settings, and modification of ladder logic. The attacker gains the ability to change configuration and potentially take full control of the PLC. The CVSSv3 score is 10.0, indicating critical impact on confidentiality, integrity, and availability [1].

Mitigation

The vendor has not publicly disclosed a specific fixed firmware version in the available references. Users should contact Rockwell Automation for patching guidance and upgrade to the latest firmware. As a workaround, restrict network access to the PLC and ensure the keyswitch is in the RUN position when not in maintenance mode [1].