Vulnerability Note VU#144233

Rockwell Automation Allen-Bradley MicroLogix PLC authentication and authorization vulnerabilities

Original Release date: 19 Jan 2010 | Last revised: 03 Jun 2010

Overview

Rockwell Automation Allen-Bradley MicroLogix programmable logic controllers (PLCs) do not adequately authenticate or authorize remote connections or commands. An attacker with network access can obtain the management password or issue commands that bypass the authentication mechanism.

Description

Rockwell Automation Allen-Bradley MicroLogix PLCs do not adequately authenticate or authorize remote connections or commands. Two vulnerable behaviors have been reported:

  1. During the authentication process, the PLC transmits the management password in plain text to the client.
  2. When processing remote commands, the PLC checks the session ID but not the password. The PLC will execute any command with a valid session ID, and obtaining an ID does not require the password.
It appears that authentication is performed at the client (e.g., RSLogix), as the PLC does not check the password in either case.

These vulnerabilities have been reported in the MicroLogix 1100 PLC. Other products in the MicroLogix series may also be affected.

Impact

An attacker with network access to a controller could obtain the management password or issue commands that bypass the authentication mechanism. The attacker could disable the controller or change the configuration.

Solution

Updated firmware is not available. Consider the workarounds listed below. Also, please see Technotes 65980 and 65982.

Restrict access

To reduce exposure to attacks, restrict network access to PLCs. Following the principle of least privilege, control system networks should not be generally accessible from enterprise networks or the internet. Permit only network traffic that is required for control system operation.

Change passwords

Changing passwords can prevent an attacker from accessing a PLC if the password is changed before the attacker attempts access or if different passwords are used on different PLCs. An attacker with network access can obtain the current password.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
Rockwell AutomationAffected04 Sep 200903 Jun 2010
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

Thanks to Eyal Udassin of C4 Security for researching and reporting these vulnerabilities. Thanks also to Rockwell Automation for providing technical assistance and developing mitigation techniques.

This document was written by Art Manion.

Other Information

  • CVE IDs: CVE-2009-3739
  • Date Public: 18 Dec 2009
  • Date First Published: 19 Jan 2010
  • Date Last Updated: 03 Jun 2010
  • Severity Metric: 8.91
  • Document Revision: 23

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.