Rockwellautomation Micrologix 1400 Firmware vulnerabilities

11 CVEs affecting Rockwellautomation Micrologix 1400 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-46670, published 2022-12-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-6490, published 2015-10-28. Critical severity, CVSS 9.8. EPSS: 7% chance of exploitation in the next 30 days. Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices through B FRN 15.003 allows remote attackers to execute arbitrary code via unspecified…
CVE-2015-6492, published 2015-10-28. High severity, CVSS 7.5. EPSS: 4.5% chance of exploitation in the next 30 days. Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote attackers to cause a denial of service (memory corruption and device crash) via a crafted…
CVE-2018-17924, published 2018-12-07. High severity, CVSS 8.6. EPSS: 4.3% chance of exploitation in the next 30 days. Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and…
CVE-2015-6486, published 2015-10-28. Medium severity, CVSS 6.5. EPSS: 4.3% chance of exploitation in the next 30 days. SQL injection vulnerability on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote authenticated users to execute arbitrary SQL commands via…
CVE-2021-32926, published 2021-06-03. High severity, CVSS 7.5. EPSS: 3% chance of exploitation in the next 30 days. When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate, new password hash and replace it with an…
CVE-2015-6488, published 2015-10-28. Medium severity, CVSS 4.3. EPSS: 2.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the web server on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allows remote attackers to inject…
CVE-2021-22659, published 2021-03-25. High severity, CVSS 8.6. EPSS: 1.8% chance of exploitation in the next 30 days. Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random…
CVE-2022-2179, published 2022-07-20. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.
CVE-2015-6491, published 2015-10-28. Medium severity, CVSS 4.0. EPSS: 1.6% chance of exploitation in the next 30 days. Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN 15.003 allow remote authenticated users to insert the content of an arbitrary file into a FRAME element via…
CVE-2022-3166, published 2022-12-16. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to a denial-of-service condition. The security vulnerability…

Latest

CVE-2022-46670, published 2022-12-16. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. Rockwell Automation was made aware of a vulnerability by a security researcher from Georgia Institute of Technology that the MicroLogix 1100 and 1400 controllers contain a vulnerability that may…