Quantum Secular Labs / Blog / Advisories

CVE-2016-9343: By sending malformed common industrial protocol (CIP) packet, an attacker may be able to overflow a…

CVE-2016-9343 is rated critical with a CVSS v3.1 base score of 10.0 and NVD lists 16 affected products, including Rockwellautomation Softlogix 5800 Controller Firmware. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

An issue was discovered in Rockwell Automation Logix5000 Programmable Automation Controller FRN 16.00 through 21.00 (excluding all firmware versions prior to FRN 16.00, which are not affected). By sending malformed common industrial protocol (CIP) packet, an attacker may be able to overflow a stack-based buffer and execute code on the controller or initiate a nonrecoverable fault resulting in a denial of service.

Severity breakdown

CVSS v3.1 10.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-787: Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

Affected products

  • Rockwellautomation Softlogix 5800 Controller Firmware: 18.00; 19.00; 20.00; 21.00
  • Rockwellautomation Rslogix Emulate 5000 Firmware: 18.00; 19.00; 20.00; 21.00
  • Rockwellautomation Guardlogix 5570 Controller Firmware: 16.00; 17.00; 18.00; 19.00; 20.00; 20.010; 20.017; 21.00
  • Rockwellautomation Flexlogix L34 Controller Firmware: 16.00
  • Rockwellautomation Controllogix L55 Controller Firmware: 16.00; 16.020; 16.022
  • Rockwellautomation Controllogix 5570 Redundant Controller Firmware: 20.00; 20.050; 20.055; 21.00
  • Rockwellautomation Controllogix 5570 Controller Firmware: 18.00; 19.00; 20.010; 20.013; 21.00
  • Rockwellautomation Controllogix 5560 Redundant Controller Firmware: 16.00; 19.00; 20.00; 20.050; 20.055
  • Rockwellautomation Controllogix 5560 Controller Firmware: 16.00; 16.020; 16.022; 17.00; 18.00; 19.00; 20.00; 20.010; 20.013
  • Rockwellautomation 1769 Compactlogix L3x Controller Firmware: 16.00; 16.020; 16.023; 17.00; 18.00; 19.00; 20.00; 20.010; 20.013
  • Rockwellautomation 1769 Compactlogix L23x Controller Firmware: 16.00; 17.00; 18.00; 19.00; 20.00; 20.010; 20.013
  • Rockwellautomation 1769 Compactlogix 5370 L3 Controller Firmware: 20.00; 20.010; 20.013; 21.00
  • Rockwellautomation 1769 Compactlogix 5370 L2 Controller Firmware: 20.00; 20.010; 20.013; 21.00
  • Rockwellautomation 1769 Compactlogix 5370 L1 Controller Firmware: 20.00; 20.010; 20.013; 21.00
  • Rockwellautomation 1768 Compactlogix L4x Controller Firmware: 16.00; 16.020; 16.025; 17.00; 18.00; 19.00; 20.00; 20.011; 20.016

References