Vulnerability · Published Jul 20, 2022 · Assigned by icscert
CVE-2022-2179ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames
Medium 6.5
In plain English
A medium-severity security flaw in MicroLogix 1100 from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.7%top 22.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | MicroLogix 1400 | unspecified – through 21.007 |
| Rockwell Automation | MicroLogix 1100 | All versions |
Weakness: CWE-1021 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-01 x_refsource_CONFIRM
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135994 x_refsource_CONFIRM