var-202003-1613
Vulnerability from variot
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic key utilized to help protect the account password is hard coded into the RSLogix 500 binary file. An attacker could identify cryptographic keys and use it for further cryptographic attacks that could ultimately lead to a remote attacker gaining unauthorized access to the controller. Rockwell Automation MicroLogix 1400 , MicroLogix 1100 controller, RSLogix 500 The software contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Rockwell Automation MicroLogix 1400 Controllers Series A and others are products of Rockwell Automation (USA). Rockwell Automation MicroLogix 1400 Controllers Series A is a programmable logic controller. MicroLogix 1100 Controllers is a programmable logic controller. RSLogix 500 Software is a set of programming software for industrial control systems.
Vulnerabilities in trust management issues exist in many Rockwell Automation products. The vulnerability stems from the RSLogix 500 binary file with a hard-coded encryption key used to protect the account password
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202003-1613", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "micrologix 1400 b", "scope": "lte", "trust": 1.0, "vendor": "rockwellautomation", "version": "21.001" }, { "model": "micrologix 1400 a", "scope": "eq", "trust": 1.0, "vendor": "rockwellautomation", "version": "*" }, { "model": "micrologix 1100", "scope": "eq", "trust": 1.0, "vendor": "rockwellautomation", "version": "*" }, { "model": "rslogix 500", "scope": "lte", "trust": 1.0, "vendor": "rockwellautomation", "version": "12.001" }, { "model": "micrologix 1100", "scope": "eq", "trust": 0.8, "vendor": "rockwell automation", "version": "rslogix 5000" }, { "model": "micrologix 1400 a", "scope": null, "trust": 0.8, "vendor": "rockwell automation", "version": null }, { "model": "micrologix 1400 b", "scope": "eq", "trust": 0.8, "vendor": "rockwell automation", "version": "21.001" }, { "model": "rslogix 5000", "scope": "eq", "trust": 0.8, "vendor": "rockwell automation", "version": "12.001" }, { "model": "automation micrologix controllers series a", "scope": "eq", "trust": 0.6, "vendor": "rockwell", "version": "1400" }, { "model": "automation micrologix controllers series b", "scope": "eq", "trust": 0.6, "vendor": "rockwell", "version": "1400\u003c=21.001" }, { "model": "automation micrologix controllers", "scope": "eq", "trust": 0.6, "vendor": "rockwell", "version": "1100" }, { "model": "automation rslogix software", "scope": "eq", "trust": 0.6, "vendor": "rockwell", "version": "500\u003c=12.001" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "micrologix 1400 a", "version": "*" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "micrologix 1400 b", "version": "*" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "micrologix 1100", "version": "*" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "rslogix 500", "version": "*" } ], "sources": [ { "db": "IVD", "id": "7d0fad42-360f-41a5-991b-69082cdd59c7" }, { "db": "CNVD", "id": "CNVD-2020-19523" }, { "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "db": "NVD", "id": "CVE-2020-6990" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/o:rockwellautomation:micrologix_1100_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:rockwellautomation:micrologix_1400_a_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/o:rockwellautomation:micrologix_1400_b_firmware", "vulnerable": true }, { "cpe22Uri": "cpe:/a:rockwellautomation:rslogix_5000", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2020-003039" } ] }, "cve": "CVE-2020-6990", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "CVE-2020-6990", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 1.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Complete", "baseScore": 10.0, "confidentialityImpact": "Complete", "exploitabilityScore": null, "id": "JVNDB-2020-003039", "impactScore": null, "integrityImpact": "Complete", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "CNVD-2020-19523", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "IVD", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "7d0fad42-360f-41a5-991b-69082cdd59c7", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.2, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.9 [IVD]" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "exploitabilityScore": 10.0, "id": "VHN-185115", "impactScore": 10.0, "integrityImpact": "COMPLETE", "severity": "HIGH", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "exploitabilityScore": 3.9, "id": "CVE-2020-6990", "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 9.8, "baseSeverity": "Critical", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "JVNDB-2020-003039", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2020-6990", "trust": 1.0, "value": "CRITICAL" }, { "author": "NVD", "id": "JVNDB-2020-003039", "trust": 0.8, "value": "Critical" }, { "author": "CNVD", "id": "CNVD-2020-19523", "trust": 0.6, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-202003-558", "trust": 0.6, "value": "CRITICAL" }, { "author": "IVD", "id": "7d0fad42-360f-41a5-991b-69082cdd59c7", "trust": 0.2, "value": "HIGH" }, { "author": "VULHUB", "id": "VHN-185115", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "IVD", "id": "7d0fad42-360f-41a5-991b-69082cdd59c7" }, { "db": "CNVD", "id": "CNVD-2020-19523" }, { "db": "VULHUB", "id": "VHN-185115" }, { "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "db": "CNNVD", "id": "CNNVD-202003-558" }, { "db": "NVD", "id": "CVE-2020-6990" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic key utilized to help protect the account password is hard coded into the RSLogix 500 binary file. An attacker could identify cryptographic keys and use it for further cryptographic attacks that could ultimately lead to a remote attacker gaining unauthorized access to the controller. Rockwell Automation MicroLogix 1400 , MicroLogix 1100 controller, RSLogix 500 The software contains a vulnerability in the use of hard-coded credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Rockwell Automation MicroLogix 1400 Controllers Series A and others are products of Rockwell Automation (USA). Rockwell Automation MicroLogix 1400 Controllers Series A is a programmable logic controller. MicroLogix 1100 Controllers is a programmable logic controller. RSLogix 500 Software is a set of programming software for industrial control systems. \n\r\n\r\nVulnerabilities in trust management issues exist in many Rockwell Automation products. The vulnerability stems from the RSLogix 500 binary file with a hard-coded encryption key used to protect the account password", "sources": [ { "db": "NVD", "id": "CVE-2020-6990" }, { "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "db": "CNVD", "id": "CNVD-2020-19523" }, { "db": "IVD", "id": "7d0fad42-360f-41a5-991b-69082cdd59c7" }, { "db": "VULHUB", "id": "VHN-185115" } ], "trust": 2.43 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2020-6990", "trust": 3.3 }, { "db": "ICS CERT", "id": "ICSA-20-070-06", "trust": 3.1 }, { "db": "CNNVD", "id": "CNNVD-202003-558", "trust": 0.9 }, { "db": "CNVD", "id": "CNVD-2020-19523", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2020-003039", "trust": 0.8 }, { "db": "NSFOCUS", "id": "46115", "trust": 0.6 }, { "db": "IVD", "id": "7D0FAD42-360F-41A5-991B-69082CDD59C7", "trust": 0.2 }, { "db": "VULHUB", "id": "VHN-185115", "trust": 0.1 } ], "sources": [ { "db": "IVD", "id": "7d0fad42-360f-41a5-991b-69082cdd59c7" }, { "db": "CNVD", "id": "CNVD-2020-19523" }, { "db": "VULHUB", "id": "VHN-185115" }, { "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "db": "CNNVD", "id": "CNNVD-202003-558" }, { "db": "NVD", "id": "CVE-2020-6990" } ] }, "id": "VAR-202003-1613", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "IVD", "id": "7d0fad42-360f-41a5-991b-69082cdd59c7" }, { "db": "CNVD", "id": "CNVD-2020-19523" }, { "db": "VULHUB", "id": "VHN-185115" } ], "trust": 1.8345238 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "ICS", "Network device" ], "sub_category": null, "trust": 0.6 }, { "category": [ "ICS" ], "sub_category": null, "trust": 0.2 } ], "sources": [ { "db": "IVD", "id": "7d0fad42-360f-41a5-991b-69082cdd59c7" }, { "db": "CNVD", "id": "CNVD-2020-19523" } ] }, "last_update_date": "2024-11-23T22:05:45.376000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Top Page", "trust": 0.8, "url": "https://ab.rockwellautomation.com/" }, { "title": "Patch for Multiple Rockwell Automation product trust management issues", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchInfo/show/210939" }, { "title": "Multiple Rockwell Automation Product security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=111504" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-19523" }, { "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "db": "CNNVD", "id": "CNNVD-202003-558" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-798", "trust": 1.9 }, { "problemtype": "CWE-321", "trust": 1.0 } ], "sources": [ { "db": "VULHUB", "id": "VHN-185115" }, { "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "db": "NVD", "id": "CVE-2020-6990" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 3.1, "url": "https://www.us-cert.gov/ics/advisories/icsa-20-070-06" }, { "trust": 1.4, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6990" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-6990" }, { "trust": 0.6, "url": "http://www.nsfocus.net/vulndb/46115" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2020-19523" }, { "db": "VULHUB", "id": "VHN-185115" }, { "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "db": "CNNVD", "id": "CNNVD-202003-558" }, { "db": "NVD", "id": "CVE-2020-6990" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "IVD", "id": "7d0fad42-360f-41a5-991b-69082cdd59c7" }, { "db": "CNVD", "id": "CNVD-2020-19523" }, { "db": "VULHUB", "id": "VHN-185115" }, { "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "db": "CNNVD", "id": "CNNVD-202003-558" }, { "db": "NVD", "id": "CVE-2020-6990" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-03-10T00:00:00", "db": "IVD", "id": "7d0fad42-360f-41a5-991b-69082cdd59c7" }, { "date": "2020-03-26T00:00:00", "db": "CNVD", "id": "CNVD-2020-19523" }, { "date": "2020-03-16T00:00:00", "db": "VULHUB", "id": "VHN-185115" }, { "date": "2020-04-02T00:00:00", "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "date": "2020-03-10T00:00:00", "db": "CNNVD", "id": "CNNVD-202003-558" }, { "date": "2020-03-16T16:15:14.843000", "db": "NVD", "id": "CVE-2020-6990" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-03-26T00:00:00", "db": "CNVD", "id": "CNVD-2020-19523" }, { "date": "2020-03-20T00:00:00", "db": "VULHUB", "id": "VHN-185115" }, { "date": "2020-04-02T00:00:00", "db": "JVNDB", "id": "JVNDB-2020-003039" }, { "date": "2020-03-23T00:00:00", "db": "CNNVD", "id": "CNNVD-202003-558" }, { "date": "2024-11-21T05:36:26.807000", "db": "NVD", "id": "CVE-2020-6990" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202003-558" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "plural Rockwell Automation Vulnerabilities in the use of hard-coded credentials in products", "sources": [ { "db": "JVNDB", "id": "JVNDB-2020-003039" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "trust management problem", "sources": [ { "db": "CNNVD", "id": "CNNVD-202003-558" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.