title: Rockwell Automation Allen-Bradley ControlLogix Communication Modules vulnerable to Denial of Service
description:
Where this vulnerability exists in the Rockwell Automation 1756-EN4* Ethernet/IP communication products, it could allow a malicious user to cause a denial of service by asserting the target system through maliciously crafted CIP messages.
problem types: CWE-787 Out-of-bounds Write
affected:
{
defaultStatus: unaffected
product: 1756-EN4TR Series A
vendor: Rockwell Automation
versions:
status: affected, version: <=5.001
}
{
defaultStatus: unaffected
product: 1756-EN4TRK Series A
vendor: Rockwell Automation
versions:
status: affected, version: <=5.001
}
{
defaultStatus: unaffected
product: 1756-EN4TRXT Series A
vendor: Rockwell Automation
versions:
status: affected, version: <=5.001
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
*  Update firmware. Update EN4* ControlLogix communications modules to firmware revision 5.002.
*  Properly segment networks. Given a cyber actor would require network connectivity to the communication module to exploit the vulnerability, organizations should ensure ICS/SCADA networks are properly segmented within the process structure as well as from the Internet and other non-essential networks.
*  Implement detection signatures. Use appended Snort signatures to monitor and detect anomalous Common Industrial Protocol (CIP) packets to Rockwell Automation devices.