CVE-2022-46670
EUVD-2022-4946616.12.2022, 21:15
Rockwell Automation was made aware of a vulnerability by a security researcher from Georgia Institute of Technology that the MicroLogix 1100 and 1400 controllers contain a vulnerability that may give an attacker the ability to accomplish remote code execution. The vulnerability is an unauthenticated stored cross-site scripting vulnerability in the embedded webserver. The payload is transferred to the controller over SNMP and is rendered on the homepage of the embedded website.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| rockwellautomation | micrologix_1400_firmware | - |
| rockwellautomation | micrologix_1100_firmware | - |
| rockwellautomation | micrologix_1400-b_firmware | 𝑥 ≤ 21.007 |
| rockwellautomation | micrologix_1400-c_firmware | 𝑥 ≤ 21.007 |
| rockwellautomation | micrologix_1400-a_firmware | 𝑥 ≤ 7.000 |
𝑥
= Vulnerable software versions