Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-6990

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic key utilized to help protect the account password is hard coded into the RSLogix 500 binary file. An attacker could identify cryptographic keys and use it for further cryptographic attacks that could ultimately lead to a remote attacker gaining unauthorized access to the controller.

Published

2020-03-16T16:15:14.843

Last Modified

2024-11-21T05:36:26.807

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

10.0

Impact Score

10.0

Weaknesses
  • Type: Secondary
    CWE-321
  • Type: Primary
    CWE-798
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System rockwellautomation micrologix_1400_a_firmware * Yes
Operating System rockwellautomation micrologix_1400_b_firmware ≤ 21.001 Yes
Hardware rockwellautomation micrologix_1400 - No
Operating System rockwellautomation micrologix_1100_firmware * Yes
Hardware rockwellautomation micrologix_1100 - No
Application rockwellautomation rslogix_500 ≤ 12.001 Yes
References