CVE-2021-22659 Memory corruption in Rockwell Automation MicroLogix 1400
Remote unauthenticated attackers can cause denial of service and read or modify register values via crafted Modbus packets in MicroLogix 1400 PLCs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-22659?
CVE-2021-22659 is a high-severity memory corruption vulnerability in Rockwell Automation MicroLogix 1400, published on 25 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user.
Weakness: CWE-120
Which versions are affected by CVE-2021-22659?
It affects 1 product.
Products include Rockwellautomation Micrologix 1400 Firmware.
How do I fix CVE-2021-22659?
No fix has been published for CVE-2021-22659 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-22659 being exploited?
There is no known exploitation of CVE-2021-22659 in the wild and no public exploit code.
Sources
Also known as GHSA-fv9f-8rj8-45rf.