csaf_cisa - icsa-18-310-02

icsa-18-310-02

Vulnerability from csaf_cisa

Published

2018-11-06 00:00

Modified

2018-12-06 00:00

Summary

Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules

Notes

CISA Disclaimer

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Risk evaluation

Successful exploitation of this vulnerability could allow an unauthenticated attacker to modify system settings and cause a loss of communication between the device and the system.

Critical infrastructure sectors

Critical Manufacturing, Food and Agriculture, Transportation Systems, Water and Wastewater Systems

Countries/areas deployed

Worldwide

Company headquarters location

United States

Recommended Practices

NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Recommended Practices

NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.

Exploitability

No known public exploits specifically target this vulnerability.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "David Noren"
        ],
        "summary": "reporting this vulnerability to NCCIC"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of this vulnerability could allow an unauthenticated attacker to modify system settings and cause a loss of communication between the device and the system.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Critical Manufacturing, Food and Agriculture, Transportation Systems, Water and Wastewater Systems",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "NCCIC recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target this vulnerability.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-18-310-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2018/icsa-18-310-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-18-310-02 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-18-310-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules",
    "tracking": {
      "current_release_date": "2018-12-06T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-18-310-02",
      "initial_release_date": "2018-11-06T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2018-11-06T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-18-310-02P Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules"
        },
        {
          "date": "2018-12-06T00:00:00.000000Z",
          "legacy_version": "A",
          "number": "2",
          "summary": "ICSA-18-310-02 Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules (Update A)"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2TR Series A: all versions",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2TR Series A"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 10.10",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2T Series D: v10.10 and earlier",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2T Series D"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EWEB Series B: all versions",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EWEB Series B"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "MicroLogix 1400 Controllers Series A: all versions",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "MicroLogix 1400 Controllers Series A"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 21.003",
                "product": {
                  "name": "MicroLogix 1400 Controllers Series B: v21.003 and earlier",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "MicroLogix 1400 Controllers Series B"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 21.003",
                "product": {
                  "name": "MicroLogix 1400 Controllers Series C: v21.003 and earlier",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "MicroLogix 1400 Controllers Series C"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-ENBT: all versions",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-ENBT"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2F Series B: all versions",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2F Series B"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2TR Series B: all versions",
                  "product_id": "CSAFPID-0009"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2TR Series B"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2T Series C: all versions",
                  "product_id": "CSAFPID-00010"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2T Series C"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN3TR Series A: all versions",
                  "product_id": "CSAFPID-00011"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN3TR Series A"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2T Series B: all versions",
                  "product_id": "CSAFPID-00012"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2T Series B"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 10.10",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN3TR Series B: v10.10 and earlier",
                  "product_id": "CSAFPID-00013"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN3TR Series B"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2F Series A: all versions",
                  "product_id": "CSAFPID-00014"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2F Series A"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 10.10",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2TR Series C: v10.10 and earlier",
                  "product_id": "CSAFPID-00015"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2TR Series C"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EWEB Series A: all versions",
                  "product_id": "CSAFPID-00016"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EWEB Series A"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "vers:all/*",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2T Series A: all versions",
                  "product_id": "CSAFPID-00017"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2T Series A"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c= 10.10",
                "product": {
                  "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2F Series A: v10.10 and earlier",
                  "product_id": "CSAFPID-00018"
                }
              }
            ],
            "category": "product_name",
            "name": "1756 ControlLogix EtherNet/IP Communications Modules 1756-EN2F Series A"
          }
        ],
        "category": "vendor",
        "name": "Rockwell Automation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2018-17924",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "notes": [
        {
          "category": "summary",
          "text": "An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address. CVE-2018-17924 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-00010",
          "CSAFPID-00011",
          "CSAFPID-00012",
          "CSAFPID-00013",
          "CSAFPID-00014",
          "CSAFPID-00015",
          "CSAFPID-00016",
          "CSAFPID-00017",
          "CSAFPID-00018"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-17924"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "For MicroLogix 1400 Controllers 1766-Lxxx, Series B or C, apply FRN 21.004 and later. Once the new FRN is applied, use the LCD Display to put the controller in RUN mode to prevent configuration changes. See p. 115 of the MicroLogix 1400 Programmable Controllers User Manual (1766-UM001M-EN-P) for details (available at the following location):",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ],
          "url": "https://literature.rockwellautomation.com/idc/groups/literature/documents/um/1766-um001_-en-p.pdf"
        },
        {
          "category": "mitigation",
          "details": "The download for FRN 21.004 can be found at the following location:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ],
          "url": "https://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=1766-L\u0026crumb=112"
        },
        {
          "category": "mitigation",
          "details": "1756 ControlLogix EtherNet/IP Communications Modules, 1756-ENBT, all versions, 1756-EN2F Series A, all versions, Series B, all versions. 1756-EN2T, Series A, all versions, Series B, all versions, Series C, all versions. 1756-EN2TR Series A, all versions, Series B, all versions. 1756-EN3TR Series A. No direct mitigation provided. See additional mitigating recommendations below for suggested actions.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ]
        },
        {
          "category": "mitigation",
          "details": "1756 ControlLogix EtherNet/IP Communications Modules, 1756-EN2F, Series C, 1756-EN2T, Series D, 1756-EN2TR, Series C, 1756-EN3TR, Series B. The recommendations are to apply FRN 11.001 and later. Once the new FRN is applied, enable Explicit Protected Mode. See p. 32 of the EtherNet/IP Network Configuration User Manual (ENET-UM001-EN-P) for details. Available at the following location:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ],
          "url": "https://literature.rockwellautomation.com/idc/groups/literature/documents/um/enet-um001_-en-p.pdf"
        },
        {
          "category": "mitigation",
          "details": "The download for FRN 11.001 can be found at the following location:",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ],
          "url": "https://compatibility.rockwellautomation.com/Pages/MultiProductDownload.aspx?Keyword=1756-EN\u0026crumb=112"
        },
        {
          "category": "mitigation",
          "details": "Utilize proper network infrastructure controls, such as firewalls, to help ensure that EtherNet/IP messages from unauthorized sources are blocked.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ]
        },
        {
          "category": "mitigation",
          "details": "Consult the product documentation for specific features, such as a hardware key switch setting, which may be used to block unauthorized changes, etc.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ]
        },
        {
          "category": "mitigation",
          "details": "Block all traffic to EtherNet/IP or other CIP protocol-based devices from outside the operational zone by blocking or restricting access to Port 2222/TCP and UDP and Port 44818 using proper network infrastructure controls, such as firewalls, UTM devices, or other security appliances. For more information on TCP/UDP Ports used by Rockwell Automation Products, see Knowledgebase Article ID 898270.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use trusted software, software patches, antivirus/antimalware programs and interact only with trusted websites and attachments.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locate control system networks and devices behind firewalls, and isolate them from the business network.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ]
        },
        {
          "category": "mitigation",
          "details": "For additional information, Rockwell Automation recommends users continue to monitor their advisory by subscribing to updates on the Security Advisory Index for Rockwell Automation, located at: 54102 - Industrial Security Advisory Index at the following location (login required):",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ],
          "url": "https://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-00010",
            "CSAFPID-00011",
            "CSAFPID-00012",
            "CSAFPID-00013",
            "CSAFPID-00014",
            "CSAFPID-00015",
            "CSAFPID-00016",
            "CSAFPID-00017",
            "CSAFPID-00018"
          ]
        }
      ]
    }
  ]
}

CVE-2018-17924 (GCVE-0-2018-17924)

Vulnerability from cvelistv5

Published

2018-12-07 14:00

Modified

2024-08-05 11:01

Severity ?

CWE

CWE-306 - MISSING AUTHENTICATION FOR CRITICAL FUNCTION

Summary

Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/106132	vdb-entry, x_refsource_BID
	https://ics-cert.us-cert.gov/advisories/ICSA-18-310-02	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	Rockwell Automation	Version: MicroLogix 1400 Controllers Series A, all versions, Series B, v21.003 and earlier,Series C, v21.003 and earlier, 1756 ControlLogix EtherNet/IP Communications Modules 1756-ENBT, all versions, 1756-EWEB Series A, all versions Series B, all versions, 1756-EN2F Series A, all versions, Series B, all versions, Series C, v10.10 and earlier, 1756-EN2T, Series A, all versions, Series B, all versions, Series C, all versions, Series D, v10.10 and earlier, 1756-EN2TR, Series A, all versions, Series B, all versions, Series C, v10.10 and earlier, 1756-EN3TR, Series A, all versions, Series B, v10.10 and earlier.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T11:01:14.626Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "106132",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106132"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-310-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Rockwell Automation",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "MicroLogix 1400 Controllers Series A, all versions, Series B, v21.003 and earlier,Series C, v21.003 and earlier, 1756 ControlLogix EtherNet/IP Communications Modules 1756-ENBT, all versions, 1756-EWEB Series A, all versions Series B, all versions, 1756-EN2F Series A, all versions, Series B, all versions, Series C, v10.10 and earlier, 1756-EN2T, Series A, all versions, Series B, all versions, Series C, all versions, Series D, v10.10 and earlier, 1756-EN2TR, Series A, all versions, Series B, all versions, Series C, v10.10 and earlier, 1756-EN3TR, Series A, all versions, Series B, v10.10 and earlier."
            }
          ]
        }
      ],
      "datePublic": "2018-12-07T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-08T10:57:01",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "name": "106132",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106132"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-310-02"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2018-17924",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Rockwell Automation",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "MicroLogix 1400 Controllers Series A, all versions, Series B, v21.003 and earlier,Series C, v21.003 and earlier, 1756 ControlLogix EtherNet/IP Communications Modules 1756-ENBT, all versions, 1756-EWEB Series A, all versions Series B, all versions, 1756-EN2F Series A, all versions, Series B, all versions, Series C, v10.10 and earlier, 1756-EN2T, Series A, all versions, Series B, all versions, Series C, all versions, Series D, v10.10 and earlier, 1756-EN2TR, Series A, all versions, Series B, all versions, Series C, v10.10 and earlier, 1756-EN3TR, Series A, all versions, Series B, v10.10 and earlier."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "MISSING AUTHENTICATION FOR CRITICAL FUNCTION CWE-306"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "106132",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106132"
            },
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-18-310-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-18-310-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2018-17924",
    "datePublished": "2018-12-07T14:00:00",
    "dateReserved": "2018-10-02T00:00:00",
    "dateUpdated": "2024-08-05T11:01:14.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

icsa-18-310-02

Vulnerability from csaf_cisa

CVE-2018-17924 (GCVE-0-2018-17924)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature