The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules
Vendor
Rockwell Automation
Product
1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules
Platforms
Unknown
Default status
unaffected
1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All
affected
Unavailable
Unavailable
Unavailable
None listed
CompactLogix L32E and L35E controllers
Vendor
Rockwell Automation
Product
CompactLogix L32E and L35E controllers
Platforms
Unknown
Default status
unaffected
CompactLogix L32E and L35E controllers · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All
affected
Unavailable
Unavailable
Unavailable
None listed
1788-ENBT FLEXLogix adapter
Vendor
Rockwell Automation
Product
1788-ENBT FLEXLogix adapter
Platforms
Unknown
Default status
unaffected
1788-ENBT FLEXLogix adapter · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All
affected
Unavailable
Unavailable
Unavailable
None listed
1794-AENTR FLEX I/O EtherNet/IP adapter
Vendor
Rockwell Automation
Product
1794-AENTR FLEX I/O EtherNet/IP adapter
Platforms
Unknown
Default status
unaffected
1794-AENTR FLEX I/O EtherNet/IP adapter · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All
affected
Unavailable
Unavailable
Unavailable
None listed
ControlLogix, CompactLogix, GuardLogix, and SoftLogix
Vendor
Rockwell Automation
Product
ControlLogix, CompactLogix, GuardLogix, and SoftLogix
Platforms
Unknown
Default status
unaffected
ControlLogix, CompactLogix, GuardLogix, and SoftLogix · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
Unavailable
18
None listed
CompactLogix and SoftLogix controllers
Vendor
Rockwell Automation
Product
CompactLogix and SoftLogix controllers
Platforms
Unknown
Default status
unaffected
CompactLogix and SoftLogix controllers · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
custom
Unavailable
19
None listed
ControlLogix and GuardLogix controllers
Vendor
Rockwell Automation
Product
ControlLogix and GuardLogix controllers
Platforms
Unknown
Default status
unaffected
ControlLogix and GuardLogix controllers · Scoped product and version facts