Rockwellautomation vulnerabilities
336 vulnerabilities
Known vulnerabilities in Rockwellautomation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 272 products.
Products
50 of 272- Arena45 vulnerabilities
- Micrologix 1400 B22 vulnerabilities
- Thinmanager16 vulnerabilities
- Factorytalk View15 vulnerabilities
- Factorytalk Linx14 vulnerabilities
- Factorytalk Assetcentre12 vulnerabilities
- Factorytalk Services Platform12 vulnerabilities
- Controllogix 558011 vulnerabilities
- Guardlogix 558011 vulnerabilities
- Micrologix 140011 vulnerabilities
- Armorstart St 281E10 vulnerabilities
- Armorstart St 284Ee10 vulnerabilities
- Compactlogix 538010 vulnerabilities
- Armorstart Lt9 vulnerabilities
- Compactlogix 54809 vulnerabilities
- Kepserver Enterprise9 vulnerabilities
- Rslinx9 vulnerabilities
- 1756 Enbt8 vulnerabilities
- 1763 L16Awa Series A8 vulnerabilities
- 1763 L16Awa Series B8 vulnerabilities
- 1763 L16Bbb Series A8 vulnerabilities
- 1763 L16Bbb Series B8 vulnerabilities
- 1763 L16Bwa Series A8 vulnerabilities
- 1763 L16Bwa Series B8 vulnerabilities
- 1763 L16Dwd Series A8 vulnerabilities
- 1763 L16Dwd Series B8 vulnerabilities
- Compactlogix8 vulnerabilities
- Compactlogix Controllers8 vulnerabilities
- Controllogix8 vulnerabilities
- Controllogix Controllers8 vulnerabilities
- Guardlogix8 vulnerabilities
- Guardlogix Controllers8 vulnerabilities
- Micrologix8 vulnerabilities
- Micrologix 11008 vulnerabilities
- Softlogix8 vulnerabilities
- Softlogix Controllers8 vulnerabilities
- 1756 Eweb7 vulnerabilities
- 1766 L32Awa Series A7 vulnerabilities
- 1766 L32Awa Series B7 vulnerabilities
- 1766 L32Awaa Series A7 vulnerabilities
- 1766 L32Awaa Series B7 vulnerabilities
- 1766 L32Bwa Series A7 vulnerabilities
- 1766 L32Bwa Series B7 vulnerabilities
- 1766 L32Bwaa Series A7 vulnerabilities
- 1766 L32Bwaa Series B7 vulnerabilities
- 1766 L32Bxb Series A7 vulnerabilities
- 1766 L32Bxb Series B7 vulnerabilities
- 1766 L32Bxba Series A7 vulnerabilities
- 1766 L32Bxba Series B7 vulnerabilities
- 1768 Enbt7 vulnerabilities
CVE-2018-19016rockwellrockwell automation ethernet/ip web server modules 1756-eweb (includes 1756-ewebk) version 5.001 and earlier, and compactlogix 1768-eweb version 2.005 and earlier.+2
EPSS score3.19%
Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Version 2.005 and earlier. A remote attacker could send a crafted UDP packet to the SNMP service causing a denial-of-service condition to occur until the affected product is restarted.CVE-2018-19615rockwellautomationpowermonitor_1000_firmwareEPSS score3.30%
Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted userâs web browser to gain access to the affected device.CVE-2018-19616rockwellautomationpowermonitor_1000_firmwareEPSS score30.29%
An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element.CVE-2018-19282rockwellautomationpowerflex_525_ac_drives_firmwareEPSS score5.64%
Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Industrial Protocol (CIP) network stack. The vulnerability allows the attacker to crash the CIP in a way that it does not accept new connections, but keeps the current connections active, which can prevent legitimate users from recovering control.CVE-2018-14829rockwell automationrslinx classic®+1EPSS score16.09%
Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote threat actor to intentionally send a malformed CIP packet to Port 44818, causing the software application to stop responding and crash. This vulnerability also has the potential to exploit a buffer overflow condition, which may allow the threat actor to remotely execute arbitrary code.CVE-2018-14821rockwell automationrslinx classic®+1EPSS score4.50%
Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intentionally send a malformed CIP packet to Port 44818, causing the RSLinx Classic application to terminate. The user will need to manually restart the software to regain functionality.CVE-2018-14827rockwell automationrslinx classic®+1EPSS score3.76%
Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP packets to Port 44818, causing the software application to stop responding and crash. The user must restart the software to regain functionality.CVE-2018-17924rockwellautomation1756-en2f_series_a_firmware+15EPSS score4.33%
Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connection request to an affected device, and upon successful connection, send a new IP configuration to the affected device even if the controller in the system is set to Hard RUN mode. When the affected device accepts this new IP configuration, a loss of communication occurs between the device and the rest of the system as the system traffic is still attempting to communicate with the device via the overwritten IP address.CVE-2018-18981rockwellrockwell automation factorytalk services platform v2.90 and earlier+1EPSS score3.87%
In Rockwell Automation FactoryTalk Services Platform 2.90 and earlier, a remote unauthenticated attacker could send numerous crafted packets to service ports resulting in memory consumption that could lead to a partial or complete denial-of-service condition to the affected services.CVE-2018-10619ics-certrockwell automation rslinx classic and factorytalk linx gateway+2EPSS score2.72%
An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may allow an authorized, but non-privileged local user to execute arbitrary code and allow a threat actor to escalate user privileges on the affected workstation.CVE-2018-8843ics-certrockwell automation arena+1EPSS score1.99%
Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software files that may cause the software application to crash, potentially losing any unsaved data..CVE-2013-2806rockwell automationrslinx enterprise software+1EPSS score3.85%
Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not handle input correctly and results in a logic error if it calculates an incorrect value for the “End of Current Record” field. By sending a datagram to the service over Port 4444/UDP with the “Record Data Size” field modified to a specifically oversized value, the service will calculate an undersized value for the “Total Record Size.” Then the service will calculate an incorrect value for the “End of Current Record” field causing access violations that lead to a service crash. The service can be recovered with a manual reboot. The patches and details pertaining to these vulnerabilities can be found at the following Rockwell Automation security advisory link (login is required): https://rockwellautomation.custhelp.com/app/answers/detail/a_id/537599CVE-2013-2807rockwell automationrslinx enterprise software+1EPSS score3.85%
Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not handle input correctly and results in a logic error if it calculates an incorrect value for the “Total Record Size” field. By sending a datagram to the service over Port 4444/UDP with the “Record Data Size” field modified to a specifically oversized value, the service will calculate an undersized value for the “Total Record Size” that will cause an out-of-bounds read access violation that leads to a service crash. The service can be recovered with a manual reboot. The patches and details pertaining to these vulnerabilities can be found at the following Rockwell Automation Security Advisory link (login is required): https://rockwellautomation.custhelp.com/app/answers/detail/a_id/537599CVE-2013-2805rockwell automationrslinx enterprise software+1EPSS score3.85%
Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not handle input correctly and results in a logic error if it receives a datagram with an incorrect value in the “Record Data Size” field. By sending a datagram to the service over Port 4444/UDP with the “Record Data Size” field modified to an oversized value, an attacker could cause an out-of-bounds read access violation that leads to a service crash. The service can be recovered with a manual reboot. The patches and details pertaining to this vulnerability can be found at the following Rockwell Automation Security Advisory link (login is required): https://rockwellautomation.custhelp.com/app/answers/detail/a_id/537599CVE-2021-27470rockwell automationfactorytalk® assetcentre+1EPSS score3.83%
A deserialization vulnerability exists in how the LogService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.CVE-2021-27468rockwell automationfactorytalk® assetcentre+1EPSS score3.49%
The AosService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier exposes functions lacking proper authentication. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary SQL statements.CVE-2021-27471rockwell automationconnected components workbench+1EPSS score2.86%
The parsing mechanism that processes certain file types does not provide input sanitization for file paths. This may allow an attacker to craft malicious files that, when opened by Rockwell Automation Connected Components Workbench v12.00.00 and prior, can traverse the file system. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the Connected Components Workbench software. User interaction is required for this exploit to be successful.CVE-2021-27475rockwell automationconnected components workbench+1EPSS score2.99%
Rockwell Automation Connected Components Workbench v12.00.00 and prior does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.CVE-2021-27466rockwell automationfactorytalk® assetcentre+1EPSS score3.89%
A deserialization vulnerability exists in how the ArchiveService.rem service in Rockwell Automation FactoryTalk AssetCentre v10.00 and earlier verifies serialized data. This vulnerability may allow a remote, unauthenticated attacker to execute arbitrary commands in FactoryTalk AssetCentre.CVE-2021-27473rockwell automationconnected components workbench+1EPSS score0.78%
Rockwell Automation Connected Components Workbench v12.00.00 and prior does not sanitize paths specified within the .ccwarc archive file during extraction. This type of vulnerability is also commonly referred to as a Zip Slip. A local, authenticated attacker can create a malicious .ccwarc archive file that, when opened by Connected Components Workbench, will allow the attacker to gain the privileges of the software. If the software is running at SYSTEM level, the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.