Description
Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Rockwell Automation RSLogix 5000 software
Default version status: unaffected
V7 to ≤ V20.01affectedV7 to ≤ V21.0affectedV20.03unaffectedV21.03unaffected
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90981 ↗
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-021-01 ↗
- http://osvdb.org/102858 ↗
- http://www.securityfocus.com/bid/65337 ↗
- https://rockwellautomation.custhelp.com/app/answers/detail/a_id/565204 ↗
- http://ics-cert.us-cert.gov/advisories/ICSA-14-021-01 ↗