CVE-2020-6988
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, A remote, unauthenticated attacker can send a request from the RSLogix…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.02%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, A remote, unauthenticated attacker can send a request from the RSLogix 500 software to the victim’s MicroLogix controller. The controller will then respond to the client with used password values to authenticate the user on the client-side. This method of authentication may allow an attacker to bypass authentication altogether, disclose sensitive information, or leak credentials.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 4.02% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-603, CWE-287
- Affected
- rockwellautomation/micrologix 1400 a firmware · rockwellautomation/micrologix 1400 b firmware · rockwellautomation/micrologix 1100 firmware · rockwellautomation/rslogix 500
- Source
- ics-cert@hq.dhs.gov
References
- https://www.us-cert.gov/ics/advisories/icsa-20-070-06Third Party Advisory, US Government Resource
- https://www.us-cert.gov/ics/advisories/icsa-20-070-06Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.