Rockwell Automation Micrologix 1400 Improper Input Validation

Primary CVSS: v2.0 7.1 from [email protected]

AV:N/AC:M/Au:N/C:N/I:N/A:C

Problem Types: CWE-20 | CWE-399 | CWE-20 CWE-20

Discovery Credit

CNA: Matthew Luallen of CYBATI (en)

Solutions

CNA: Rockwell Automation has released a new version of MicroLogix 1400 Series B firmware to address the vulnerability and reduce associated risk to successful exploitation. Subsequent versions of MicroLogix 1400 Series B firmware and newer will incorporate these same enhancements. Rockwell Automation recommends the following immediate mitigation strategies (when possible, multiple strategies should be employed simultaneously): * Upgrade all MicroLogix 1400 Series B controllers to Series B FRN 15.001 or higher. Current firmware for the MicroLogix 1400 Series B platform can be obtained at the following web address: http://www.rockwellautomation.com/rockwellautomation/support/pcdc.page Please refer to Rockwell Automation’s product disclosure (AID 620295) for more information on this topic available at: https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295

Workarounds

CNA: Users with Series A and Series B controllers are also recommended to apply the following risk mitigations: * Do not enable DNP3 communication in the product unless required. * Where appropriate, prohibit DNP3 communication that originates outside the perimeter of the manufacturing zone from entry into the zone by blocking communication directed at Ethernet communication Port 20000/TCP* and 20000/UDP* using appropriate security technology (e.g., a firewall, UTM devices, or other security appliance)           *Note: Ports 20000/TCP and 20000/UDP are factory defaults as per the DNP3 specification but can be reconfigured by the product owner. * Employ firewalls with ingress/egress filtering, intrusion detection/prevention systems, and validate all configurations. Evaluate firewall configurations to ensure other appropriate inbound and outbound traffic is blocked. * Restrict physical and electronic access to automation products, networks, and systems to only those individuals authorized to be in contact with control system equipment. * Employ layered security, defense-in-depth methods and network segregation and segmentation practices in system design to restrict and control access to individual products and control networks. Refer to http://www.ab.com/networks/architectures.html http://www.ab.com/networks/architectures.html%20  for comprehensive information about implementing validated architectures designed to deliver these measures. Please refer to Rockwell Automation’s product disclosure (AID 620295) for more information on this topic available at: https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295