Software Engineering Institute

Rockwell Automation Allen-Bradley MicroLogix PLCs do not adequately authenticate or authorize remote connections or commands. Two vulnerable behaviors have been reported:

1. During the authentication process, the PLC transmits the management password in plain text to the client.
2. When processing remote commands, the PLC checks the session ID but not the password. The PLC will execute any command with a valid session ID, and obtaining an ID does not require the password.

An attacker with network access to a controller could obtain the management password or issue commands that bypass the authentication mechanism. The attacker could disable the controller or change the configuration.

Updated firmware is not available. Consider the workarounds listed below. Also, please see Technotes 65980 and 65982.

Restrict access

To reduce exposure to attacks, restrict network access to PLCs. Following the principle of least privilege, control system networks should not be generally accessible from enterprise networks or the internet. Permit only network traffic that is required for control system operation.

Change passwords

Changing passwords can prevent an attacker from accessing a PLC if the password is changed before the attacker attempts access or if different passwords are used on different PLCs. An attacker with network access can obtain the current password.