CVE-2020-6988 : Security Advisory and Response

Rockwell Automation MicroLogix controllers are affected by a vulnerability that allows remote, unauthenticated attackers to bypass authentication and potentially leak credentials.

Understanding CVE-2020-6988

This CVE involves a security issue in Rockwell Automation MicroLogix controllers that could lead to unauthorized access and information disclosure.

What is CVE-2020-6988?

The vulnerability in Rockwell Automation MicroLogix controllers allows attackers to send requests from RSLogix 500 software to a victim's controller, potentially bypassing authentication and exposing sensitive information.

The Impact of CVE-2020-6988

The exploitation of this vulnerability could result in unauthorized access, disclosure of sensitive data, and potential credential leakage, posing a significant security risk to affected systems.

Technical Details of CVE-2020-6988

This section provides more in-depth technical information about the CVE.

Vulnerability Description

The vulnerability allows remote, unauthenticated attackers to obtain password values from the victim's MicroLogix controller, potentially enabling them to authenticate on the client-side without proper authorization.

Affected Systems and Versions

Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A (all versions)
MicroLogix 1100 Controller (all versions)
RSLogix 500 Software v12.001 and prior

Exploitation Mechanism

Attackers can exploit this vulnerability by sending requests from RSLogix 500 software to the victim's MicroLogix controller, tricking the controller into revealing password values that can be used for unauthorized authentication.

Mitigation and Prevention

Protecting systems from CVE-2020-6988 requires immediate action and long-term security measures.

Immediate Steps to Take

Implement network segmentation to restrict access to vulnerable systems
Monitor network traffic for any suspicious activity
Apply vendor-supplied patches or updates promptly

Long-Term Security Practices

Regularly update and patch all software and firmware
Conduct security assessments and penetration testing to identify vulnerabilities
Educate users on secure authentication practices

Patching and Updates

Rockwell Automation may release patches or updates to address this vulnerability
Stay informed about security advisories and apply relevant patches as soon as they are available