CVE-2014-5410 (GCVE-0-2014-5410)

Vulnerability from cvelistv5 – Published: 2014-10-03 18:00 – Updated: 2025-11-04 22:30
VLAI
Title
Rockwell Automation Micrologix 1400 Improper Input Validation
Summary
The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line.
Severity
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Rockwell Automation Allen-Bradley MicroLogix 1400 Affected: 0 , ≤ 1766-Lxxxxx Series A FRN 7 (custom)
Affected: 0 , ≤ 1766-Lxxxxx Series B FRN 15.000 (custom)
Unaffected: Series B FRN 15.001 or higher
guessed Create a notification for this product.
Date Public
2014-09-30 06:00
Credits
Matthew Luallen of CYBATI
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T11:41:49.068Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-254-02"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Allen-Bradley MicroLogix 1400",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "1766-Lxxxxx Series A FRN 7",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1766-Lxxxxx Series B FRN 15.000",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "Series B FRN 15.001 or higher"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthew Luallen of CYBATI"
        }
      ],
      "datePublic": "2014-09-30T06:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line.\u003c/p\u003e"
            }
          ],
          "value": "The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line."
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.1,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-04T22:30:19.113Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295"
        },
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-254-02"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-254-02.json"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRockwell Automation has released a new version of MicroLogix 1400 \nSeries B firmware to address the vulnerability and reduce associated \nrisk to successful exploitation. Subsequent versions of MicroLogix 1400 \nSeries B firmware and newer will incorporate these same enhancements.\u003c/p\u003e\n\u003cp\u003eRockwell Automation recommends the following immediate mitigation \nstrategies (when possible, multiple strategies should be employed \nsimultaneously):\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all MicroLogix 1400 Series B controllers to Series B FRN \n15.001 or higher. Current firmware for the MicroLogix 1400 Series B \nplatform can be obtained at the following web address:\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.rockwellautomation.com/rockwellautomation/support/pcdc.page\"\u003ehttp://www.rockwellautomation.com/rockwellautomation/support/pcdc.page\u003c/a\u003e\u003c/p\u003e\n\n\n\u003cp\u003ePlease refer to Rockwell Automation\u2019s product disclosure (AID 620295) for more information on this topic available at:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Rockwell Automation has released a new version of MicroLogix 1400 \nSeries B firmware to address the vulnerability and reduce associated \nrisk to successful exploitation. Subsequent versions of MicroLogix 1400 \nSeries B firmware and newer will incorporate these same enhancements.\n\n\nRockwell Automation recommends the following immediate mitigation \nstrategies (when possible, multiple strategies should be employed \nsimultaneously):\n\n\n\n  *  Upgrade all MicroLogix 1400 Series B controllers to Series B FRN \n15.001 or higher. Current firmware for the MicroLogix 1400 Series B \nplatform can be obtained at the following web address:\n\n\n\n\n http://www.rockwellautomation.com/rockwellautomation/support/pcdc.page \n\n\n\n\nPlease refer to Rockwell Automation\u2019s product disclosure (AID 620295) for more information on this topic available at:\n\n\n https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295"
        }
      ],
      "source": {
        "advisory": "ICSA-14-254-02",
        "discovery": "EXTERNAL"
      },
      "title": "Rockwell Automation Micrologix 1400 Improper Input Validation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUsers with Series A and Series B controllers are also recommended to apply the following risk mitigations:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDo not enable DNP3 communication in the product unless required.\u003c/li\u003e\n\u003cli\u003eWhere appropriate, prohibit DNP3 communication that originates \noutside the perimeter of the manufacturing zone from entry into the zone\n by blocking communication directed at Ethernet communication Port \n20000/TCP* and 20000/UDP* using appropriate security technology (e.g., a\n firewall, UTM devices, or other security appliance)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; *Note: Ports 20000/TCP and 20000/UDP are factory defaults \nas per the DNP3 specification but can be reconfigured by the product \nowner.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEmploy firewalls with ingress/egress filtering, intrusion \ndetection/prevention systems, and validate all configurations. Evaluate \nfirewall configurations to ensure other appropriate inbound and outbound\n traffic is blocked.\u003c/li\u003e\n\u003cli\u003eRestrict physical and electronic access to automation products, \nnetworks, and systems to only those individuals authorized to be in \ncontact with control system equipment.\u003c/li\u003e\u003cli\u003eEmploy layered security, defense-in-depth methods and network \nsegregation and segmentation practices in system design to restrict and \ncontrol access to individual products and control networks. Refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.ab.com/networks/architectures.html%20\"\u003ehttp://www.ab.com/networks/architectures.html\u003c/a\u003e\u0026nbsp;for comprehensive information about implementing validated architectures designed to deliver these measures.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003ePlease refer to Rockwell Automation\u2019s product disclosure (AID 620295) for more information on this topic available at:\u003c/p\u003e\n\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295\u003c/a\u003e\u003c/p\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Users with Series A and Series B controllers are also recommended to apply the following risk mitigations:\n\n\n\n  *  Do not enable DNP3 communication in the product unless required.\n\n  *  Where appropriate, prohibit DNP3 communication that originates \noutside the perimeter of the manufacturing zone from entry into the zone\n by blocking communication directed at Ethernet communication Port \n20000/TCP* and 20000/UDP* using appropriate security technology (e.g., a\n firewall, UTM devices, or other security appliance)\n\n\n\n\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 *Note: Ports 20000/TCP and 20000/UDP are factory defaults \nas per the DNP3 specification but can be reconfigured by the product \nowner.\n\n\n\n  *  Employ firewalls with ingress/egress filtering, intrusion \ndetection/prevention systems, and validate all configurations. Evaluate \nfirewall configurations to ensure other appropriate inbound and outbound\n traffic is blocked.\n\n  *  Restrict physical and electronic access to automation products, \nnetworks, and systems to only those individuals authorized to be in \ncontact with control system equipment.\n  *  Employ layered security, defense-in-depth methods and network \nsegregation and segmentation practices in system design to restrict and \ncontrol access to individual products and control networks. Refer to  http://www.ab.com/networks/architectures.html http://www.ab.com/networks/architectures.html%20 \u00a0for comprehensive information about implementing validated architectures designed to deliver these measures.\n\n\n\n\nPlease refer to Rockwell Automation\u2019s product disclosure (AID 620295) for more information on this topic available at:\n\n\n https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2014-5410",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-14-254-02",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-254-02"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2014-5410",
    "datePublished": "2014-10-03T18:00:00.000Z",
    "dateReserved": "2014-08-22T00:00:00.000Z",
    "dateUpdated": "2025-11-04T22:30:19.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2014-5410",
      "date": "2026-09-30",
      "epss": "0.04171",
      "percentile": "0.90568"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:rockwellautomation:ab_micrologix_controller:1400:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FFF2EF59-F451-490D-A7AF-E66D11493948",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line."
          },
          {
            "lang": "es",
            "value": "La caracteristica DNP3 en los controladores Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN 7 y anteriores y 1400 1766-Lxxxxx B FRN anterior a 15.001 permite a atacantes remotos causar una denegaci\u00f3n de servicio (interrupci\u00f3n del proceso) a trav\u00e9s de paquetes malformados sobre (1) una red Ethernet o (2) una l\u00ednea de seriales."
          }
        ],
        "id": "CVE-2014-5410",
        "lastModified": "2026-05-06T22:30:45.220",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 7.1,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "ics-cert@hq.dhs.gov",
              "type": "Secondary",
              "userInteractionRequired": false
            },
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 7.1,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 6.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ]
        },
        "published": "2014-10-03T18:55:06.077",
        "references": [
          {
            "source": "ics-cert@hq.dhs.gov",
            "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2014/icsa-14-254-02.json"
          },
          {
            "source": "ics-cert@hq.dhs.gov",
            "url": "https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295"
          },
          {
            "source": "ics-cert@hq.dhs.gov",
            "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-14-254-02"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory",
              "US Government Resource"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-14-254-02"
          }
        ],
        "sourceIdentifier": "ics-cert@hq.dhs.gov",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "ics-cert@hq.dhs.gov",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-399"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.