CVE-2017-14470

Vulnerability

The vulnerability exists in the float data type handling of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. The value 0xffffffff is interpreted as NaN (Not a Number) for the Float data type. When a float is set to this value and used in the PLC, a fault is triggered. This can be achieved by sending unauthenticated CIP encapsulated PCCC commands with write function codes (0xa7, 0xa9, 0xaa, 0xab) to write the NaN value to a float tag. The keyswitch must be in REMOTE, PROG, or RUN state. Note that this is not possible through RSLogix [1].

Exploitation

An attacker with network access to the PLC can send a specially crafted packet containing the NaN float value to a writable float data file. No authentication is required. The attacker uses any of the write function codes to set a float tag to 0xffffffff. The keyswitch must be in REMOTE, PROG, or RUN state. No user interaction is needed [1].

Impact

Successful exploitation triggers a fault in the PLC, causing a denial of service condition. The fault may disrupt normal operation, potentially halting the control logic. The attacker does not gain code execution or data disclosure directly from this specific vulnerability, but the fault can be used to disrupt industrial processes [1].

Mitigation

As of the advisory publication date (2017), no patch has been released for this specific vulnerability. Users should upgrade to a newer firmware version if available. Workarounds include restricting network access to the PLC using firewalls and VLANs, ensuring the keyswitch is in a secure position when not in use, and monitoring for unauthorized CIP commands. The advisory notes that this attack is not possible through RSLogix, so only direct network access is a vector [1].