Vulnerability · Published Jul 9, 2021 · Assigned by icscert

CVE-2021-33012

High 7.5

In plain English

A high-severity improper input validation in Rockwell Automation MicroLogix 1100. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.6%top 14.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause the PLC to fault when the controller is switched to RUN mode, which results in a denial-of-service condition. If successfully exploited, this vulnerability will cause the controller to fault whenever the controller is switched to RUN mode.

Affected products (as reported)

Vendor	Product	Versions
n/a	Rockwell Automation MicroLogix 1100	All Versions

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-189-01 x_refsource_MISC