CVE-2014-5410
0.05%V4
2014-10-03
18h00 +00:00
18h00 +00:00
특정 CVE 알림
특정 CVE의 변경 사항에 대한 정보를 받아보세요.
CVE 설명
Rockwell Automation Micrologix 1400 Improper Input Validation
The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line.CVE 해결 방법
Rockwell Automation has released a new version of MicroLogix 1400
Series B firmware to address the vulnerability and reduce associated
risk to successful exploitation. Subsequent versions of MicroLogix 1400
Series B firmware and newer will incorporate these same enhancements.
Rockwell Automation recommends the following immediate mitigation
strategies (when possible, multiple strategies should be employed
simultaneously):
* Upgrade all MicroLogix 1400 Series B controllers to Series B FRN
15.001 or higher. Current firmware for the MicroLogix 1400 Series B
platform can be obtained at the following web address:
http://www.rockwellautomation.com/rockwellautomation/support/pcdc.page
Please refer to Rockwell Automation’s product disclosure (AID 620295) for more information on this topic available at:
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295
CVE 정보
관련 약점
| 약점 이름 | 출처 | |
|---|---|---|
| Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
||
| Category : Resource Management Errors Weaknesses in this category are related to improper management of system resources. |
메트릭
| 메트릭 | 점수 | 심각도 | CVSS 벡터 | 출처 |
|---|---|---|---|---|
| V2 | 7.1 | AV:N/AC:M/Au:N/C:N/I:N/A:C |
EPSS
EPSS는 취약점이 악용될 가능성을 예측하는 점수 모델입니다.
EPSS 점수
EPSS 모델은 0과 1(0~100%) 사이의 확률 점수를 생성합니다. 점수가 높을수록 취약점이 악용될 가능성이 높습니다.
EPSS 백분위수
백분위수는 EPSS 점수에 따라 CVE의 순위를 매기는 데 사용됩니다. 예를 들어 EPSS 점수 기준 95번째 백분위수의 CVE는 다른 CVE의 95%보다 악용될 가능성이 높습니다.
언급된 제품
구성 0
Rockwellautomation>>Ab_micrologix_controller >> Version 1400
참고 자료
https://ics-cert.us-cert.gov/advisories/ICSA-14-254-02
Tags : Third Party Advisory, US Government Resource
Tags : Third Party Advisory, US Government Resource
