high7.1
CVE-2022-46670
Rockwell Automation was made aware of a vulnerability by a security researcher from Georgia Institute of Technology that the MicroLogix 1100 and 1400 controlle…
Impact
Rockwell Automation was made aware of a vulnerability by a security researcher from Georgia Institute of Technology that the MicroLogix 1100 and 1400 controllers contain a vulnerability that may give an attacker the ability to accomplish remote code execution. The vulnerability is an unauthenticated stored cross-site scripting vulnerability in the embedded webserver. The payload is transferred to the controller over SNMP and is rendered on the homepage of the embedded website.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rockwellautomation | Micrologix 1400 Firmware | All versions |
| Rockwellautomation | Micrologix 1100 Firmware | All versions |
| Rockwellautomation | Micrologix 1400-B Firmware | through 21.007 |
| Rockwellautomation | Micrologix 1400-C Firmware | through 21.007 |
| Rockwellautomation | Micrologix 1400-A Firmware | through 7.000 |