CVE-2017-14467

Vulnerability

An exploitable access control vulnerability exists in the data, program, and function file permissions of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before (including FRN 21.0 and FRN 15) [1]. The vulnerability allows read or write operations via CIP encapsulated PCCC commands using function codes 0xa1, 0xa2 (read) or 0xa7, 0xa9, 0xaa, 0xab (write) [1]. The required keyswitch state is REMOTE [1]. Affected versions: all Micrologix 1400 Series B up to FRN 21.2 inclusive [1].

Exploitation

An attacker can send unauthenticated specially crafted packets over the network to the PLC [1]. No authentication or prior access is required; the attacker only needs network connectivity to the device. The keyswitch must be in the REMOTE position [1]. Using the appropriate PCCC function codes, the attacker can perform read or write operations on files, including ladder logic files [1].

Impact

Successful exploitation allows the attacker to read sensitive information (e.g., ladder logic, master password), modify settings (e.g., communication protocols, network configuration), or modify ladder logic (addition, deletion, or modification of rungs) [1]. Specific ladder logic can also trigger faults and CPU state modification [1]. The impact is complete compromise of confidentiality, integrity, and availability of the PLC with a CVSSv3 score of 10.0 [1].

Mitigation

Allen Bradley (Rockwell Automation) has not publicly released a firmware fix for this vulnerability as of the publication date [1]. No workarounds are documented in the available reference. Users should monitor vendor advisories for future updates. The device may be at end-of-life; contact the vendor for support options [1].