Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-6980

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, If Simple Mail Transfer Protocol (SMTP) account data is saved in RSLogix 500, a local attacker with access to a victim’s project may be able to gather SMTP server authentication data as it is written to the project file in cleartext.

Published

2020-03-16T16:15:14.610

Last Modified

2024-11-21T05:36:25.563

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.3 (LOW)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-312
  • Type: Primary
    CWE-312
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System rockwellautomation micrologix_1400_a_firmware * Yes
Operating System rockwellautomation micrologix_1400_b_firmware ≤ 21.001 Yes
Hardware rockwellautomation micrologix_1400 - No
Operating System rockwellautomation micrologix_1100_firmware * Yes
Hardware rockwellautomation micrologix_1100 - No
Application rockwellautomation rslogix_500 ≤ 12.001 Yes
References