CVE-2017-7901 Explained : Impact and Mitigation

A vulnerability has been found in various models of Rockwell Automation Allen-Bradley MicroLogix programmable-logic controllers, potentially leading to a denial of service attack.

Understanding CVE-2017-7901

This CVE identifies a security flaw in Rockwell Automation Allen-Bradley MicroLogix controllers that could be exploited by attackers.

What is CVE-2017-7901?

The vulnerability in Rockwell Automation Allen-Bradley MicroLogix controllers allows attackers to predict TCP initial sequence numbers, enabling them to deceive or disrupt TCP connections and potentially cause a denial of service.

The Impact of CVE-2017-7901

Exploiting this vulnerability could result in a denial of service for the targeted device, affecting its availability and potentially disrupting critical operations.

Technical Details of CVE-2017-7901

This section provides more in-depth technical information about the CVE.

Vulnerability Description

The issue stems from the generation of insufficiently random TCP initial sequence numbers in various models of Rockwell Automation Allen-Bradley MicroLogix controllers, making it possible for attackers to predict these numbers based on previous values.

Affected Systems and Versions

Rockwell Automation Allen-Bradley MicroLogix 1100: 1763-L16AWA, Series A and B, Version 16.00 and earlier versions
Rockwell Automation Allen-Bradley MicroLogix 1400: 1766-L32AWA, Series A and B, Version 16.00 and earlier versions

Exploitation Mechanism

Attackers can exploit the vulnerability by predicting TCP initial sequence numbers, allowing them to deceive or disrupt TCP connections and potentially launch denial of service attacks.

Mitigation and Prevention

Protecting systems from CVE-2017-7901 requires immediate actions and long-term security practices.

Immediate Steps to Take

Implement network segmentation to isolate critical devices
Monitor network traffic for any unusual patterns or activities
Apply vendor-supplied patches or updates promptly

Long-Term Security Practices

Regularly update and patch all software and firmware
Conduct security assessments and penetration testing to identify vulnerabilities

Patching and Updates

Rockwell Automation may release patches or updates to address the vulnerability
Stay informed about security advisories and apply relevant patches promptly