CVE-2018-17924
HIGHRockwell MicroLogix 1400/1756 ControlLogix - Unauthenticated IP Overwrite via CIP
Title source: llmDescription
Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/106132
Mitigation, Third Party Advisory, US Government Resource x_refsource_misc
https://ics-cert.us-cert.gov/advisories/ICSA-18-310-02
Scores
CVSS v3
8.6
EPSS
0.0430
EPSS Percentile
90.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-306
Status
published
Products (17)
None/Rockwell Automation
MicroLogix 1400 Controllers Series A, all versions, Series B, v21.003 and earlier,Series C, v21.003
rockwellautomation/1756-en2f_series_a_firmware
rockwellautomation/1756-en2f_series_b_firmware
rockwellautomation/1756-en2f_series_c_firmware
< 10.10
rockwellautomation/1756-en2t_series_a_firmware
rockwellautomation/1756-en2t_series_b_firmware
rockwellautomation/1756-en2t_series_c_firmware
rockwellautomation/1756-en2t_series_d_firmware
< 10.10
rockwellautomation/1756-en2tr_series_a_firmware
rockwellautomation/1756-en2tr_series_b_firmware
... and 7 more
Published
Dec 07, 2018
Tracked Since
Feb 18, 2026