search menu icon-carat-right cmu-wordmark

CERT Coordination Center


Rockwell Automation Allen-Bradley MicroLogix PLC authentication and authorization vulnerabilities

Vulnerability Note VU#144233

Original Release Date: 2010-01-20 | Last Revised: 2010-06-03

Overview

Rockwell Automation Allen-Bradley MicroLogix programmable logic controllers (PLCs) do not adequately authenticate or authorize remote connections or commands. An attacker with network access can obtain the management password or issue commands that bypass the authentication mechanism.

Description

Rockwell Automation Allen-Bradley MicroLogix PLCs do not adequately authenticate or authorize remote connections or commands. Two vulnerable behaviors have been reported:

    1. During the authentication process, the PLC transmits the management password in plain text to the client.
    2. When processing remote commands, the PLC checks the session ID but not the password. The PLC will execute any command with a valid session ID, and obtaining an ID does not require the password.
    It appears that authentication is performed at the client (e.g., RSLogix), as the PLC does not check the password in either case.

    These vulnerabilities have been reported in the MicroLogix 1100 PLC. Other products in the MicroLogix series may also be affected.

    Impact

    An attacker with network access to a controller could obtain the management password or issue commands that bypass the authentication mechanism. The attacker could disable the controller or change the configuration.

    Solution

    Updated firmware is not available. Consider the workarounds listed below. Also, please see Technotes 65980 and 65982.

    Restrict access

    To reduce exposure to attacks, restrict network access to PLCs. Following the principle of least privilege, control system networks should not be generally accessible from enterprise networks or the internet. Permit only network traffic that is required for control system operation.

    Change passwords

    Changing passwords can prevent an attacker from accessing a PLC if the password is changed before the attacker attempts access or if different passwords are used on different PLCs. An attacker with network access can obtain the current password.

    Vendor Information

    144233
    Expand all

    Rockwell Automation

    Notified:  September 04, 2009 Updated:  June 03, 2010

    Status

      Affected

    Vendor Statement

    No statement is currently available from the vendor regarding this vulnerability.

    Vendor Information

    Please see Technotes 65980 and 65982.

    Vendor References

    http://rockwellautomation.custhelp.com/app/answers/detail/a_id/65980/kw/65980/r_id/113025 http://rockwellautomation.custhelp.com/app/answers/detail/a_id/65982/kw/65982/r_id/113025

    Addendum

    There are no additional comments at this time.

    If you have feedback, comments, or additional information about this vulnerability, please send us email.


    CVSS Metrics

    Group Score Vector
    Base N/A N/A
    Temporal N/A N/A
    Environmental N/A

    References

    Credit

    Thanks to Eyal Udassin of C4 Security for researching and reporting these vulnerabilities. Thanks also to Rockwell Automation for providing technical assistance and developing mitigation techniques.

    This document was written by Art Manion.

    Other Information

    CVE IDs: CVE-2009-3739
    Severity Metric: 8.91
    Date Public: 2009-12-18
    Date First Published: 2010-01-20
    Date Last Updated: 2010-06-03 19:38 UTC
    Document Revision: 23

    Sponsored by the Department of Homeland Security Office of Cybersecurity and Communications.