Rockwell ControlLogix 1756-ENBT/A EtherNet/IP Bridge Multiple Cross-Site Scripting Vulnerabilities
BID:33638
Info
Rockwell ControlLogix 1756-ENBT/A EtherNet/IP Bridge Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 33638 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 05 2009 12:00AM |
| Updated: | Feb 09 2009 08:18PM |
| Credit: | Daniel Peck of Digital Bond |
| Vulnerable: |
Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge 0 |
| Not Vulnerable: | |
Discussion
Rockwell ControlLogix 1756-ENBT/A EtherNet/IP Bridge Multiple Cross-Site Scripting Vulnerabilities
Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge is prone to multiple cross-site scripting vulnerabilities because the device's web interface fails to sufficiently sanitize user-supplied input data.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge is prone to multiple cross-site scripting vulnerabilities because the device's web interface fails to sufficiently sanitize user-supplied input data.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
Exploit / POC
Rockwell ControlLogix 1756-ENBT/A EtherNet/IP Bridge Multiple Cross-Site Scripting Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting user to view a malicious webpage.
To exploit these issues, an attacker must entice an unsuspecting user to view a malicious webpage.
Solution / Fix
Rockwell ControlLogix 1756-ENBT/A EtherNet/IP Bridge Multiple Cross-Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Rockwell ControlLogix 1756-ENBT/A EtherNet/IP Bridge Multiple Cross-Site Scripting Vulnerabilities
References:
References:
- ControlLogix 1756-ENTB/A Ethernet/IP Bridge - Potential Security Vulnerabilities (Rockwell Automation)
- Rockwell Automation Homepage (Rockwell Automation)
- Vulnerability Note VU#882619 (US-CERT)