Rockwellautomation
Page 3 of 4 — Rockwellautomation CVEs from a corpus of 350, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-14478 | High | 7.1 | 2022-02-24 | A local, authenticated attacker could use an XML External Entity (XXE) attack to exploit weakly configured XML files to access local or remote content. A succe… |
CVE-2021-33012 | High | 8.6 | 2021-07-09 | Rockwell Automation MicroLogix 1100, all versions, allows a remote, unauthenticated attacker sending specially crafted commands to cause the PLC to fault when… |
CVE-2021-32926 | High | 7.5 | 2021-06-03 | When an authenticated password change request takes place, this vulnerability could allow the attacker to intercept the message that includes the legitimate, n… |
CVE-2021-22659 | High | 8.6 | 2021-03-25 | Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the a… |
CVE-2021-22665 | High | 7.8 | 2021-03-18 | Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may… |
CVE-2020-14516 | Critical | 10.0 | 2021-03-18 | In Rockwell Automation FactoryTalk Services Platform Versions 6.10.00 and 6.11.00, there is an issue with the implementation of the SHA-256 hashing algorithm w… |
CVE-2021-22681 | Critical | 9.8 | 2021-03-03 | Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix controllers are communi… |
CVE-2020-6088 | High | 7.5 | 2021-02-04 | An exploitable denial of service vulnerability exists in the ENIP Request Path Network Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A spec… |
CVE-2020-27267 | Critical | 9.1 | 2021-01-14 | KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Aut… |
CVE-2020-27265 | Critical | 9.8 | 2021-01-14 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Aut… |
CVE-2020-27263 | Critical | 9.1 | 2021-01-14 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Aut… |
CVE-2020-13573 | High | 7.5 | 2021-01-07 | A denial-of-service vulnerability exists in the Ethernet/IP server functionality of Rockwell Automation RSLinx Classic 2.57.00.14 CPR 9 SR 3. A specially craft… |
CVE-2020-5807 | High | 7.5 | 2020-12-29 | An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics event log. The attack… |
CVE-2020-5806 | Medium | 5.5 | 2020-12-29 | An attacker-controlled memory allocation size can be passed to the C++ new operator in the CServerManager::HandleBrowseLoadIconStreamRequest in messaging.dll… |
CVE-2020-5802 | High | 7.5 | 2020-12-29 | An attacker-controlled memory allocation size can be passed to the C++ new operator in RnaDaSvr.dll by sending a specially crafted ConfigureItems message to TC… |
CVE-2020-5801 | High | 7.5 | 2020-12-29 | An attacker can craft and send an OpenNamespace message to port 4241 with valid session-id that triggers an unhandled exception in CFTLDManager::HandleRequest… |
CVE-2020-6111 | High | 7.5 | 2020-12-03 | An exploitable denial-of-service vulnerability exists in the IPv4 functionality of Allen-Bradley MicroLogix 1100 Programmable Logic Controller Systems Series B… |
CVE-2020-27255 | High | 7.5 | 2020-11-26 | A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send… |
CVE-2020-27253 | High | 7.5 | 2020-11-26 | A flaw exists in the Ingress/Egress checks routine of FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacke… |
CVE-2020-27251 | Critical | 9.8 | 2020-11-26 | A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote, unauthenticated attacker to send… |
CVE-2020-6085 | High | 7.5 | 2020-10-19 | An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A spec… |
CVE-2020-6084 | High | 7.5 | 2020-10-19 | An exploitable denial of service vulnerability exists in the ENIP Request Path Logical Segment functionality of Allen-Bradley Flex IO 1794-AENT/B 4.003. A spec… |
CVE-2020-6087 | High | 7.5 | 2020-10-14 | An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially cra… |
CVE-2020-6086 | High | 7.5 | 2020-10-14 | An exploitable denial of service vulnerability exists in the ENIP Request Path Data Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially cra… |
CVE-2020-6083 | High | 7.5 | 2020-10-14 | An exploitable denial of service vulnerability exists in the ENIP Request Path Port Segment functionality of Allen-Bradley Flex IO 1794-AENT/B. A specially cra… |
CVE-2020-12031 | High | 7.5 | 2020-07-20 | In all versions of FactoryTalk View SE, after bypassing memory corruption mechanisms found in the operating system, a local, authenticated attacker may corrupt… |
CVE-2020-12028 | High | 7.3 | 2020-07-20 | In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpo… |
CVE-2020-12027 | Medium | 4.3 | 2020-07-20 | All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to… |
CVE-2020-12029 | Critical | 9.0 | 2020-07-20 | All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to e… |
CVE-2020-12025 | Low | 3.3 | 2020-07-14 | Rockwell Automation Logix Designer Studio 5000 Versions 32.00, 32.01, and 32.02 vulnerable to an xml external entity (XXE) vulnerability, which may allow an at… |
CVE-2020-12033 | High | 8.8 | 2020-06-23 | In Rockwell Automation FactoryTalk Services Platform, all versions, the redundancy host service (RdcyHost.exe) does not validate supplied identifiers, which co… |
CVE-2020-12005 | High | 7.5 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-12003 | High | 7.5 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-12001 | Critical | 9.8 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-11999 | High | 8.1 | 2020-06-15 | FactoryTalk Linx versions 6.00, 6.10, and 6.11, RSLinx Classic v4.11.00 and prior,Connected Components Workbench: Version 12 and prior, ControlFLASH: Version 1… |
CVE-2020-12034 | High | 8.2 | 2020-05-20 | Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLi… |
CVE-2020-12038 | Medium | 5.5 | 2020-05-19 | Products that use EDS Subsystem: Version 28.0.1 and prior (FactoryTalk Linx software (Previously called RSLinx Enterprise): Versions 6.00, 6.10, and 6.11, RSLi… |
CVE-2020-10642 | High | 7.8 | 2020-04-13 | In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registry key, which could lead to the executio… |
CVE-2020-6967 | Critical | 9.8 | 2020-03-23 | In Rockwell Automation all versions of FactoryTalk Diagnostics software, a subsystem of the FactoryTalk Services Platform, FactoryTalk Diagnostics exposes a .N… |
CVE-2020-6990 | Critical | 9.8 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2020-6988 | High | 7.5 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2020-6984 | High | 7.5 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2020-6980 | Low | 3.3 | 2020-03-16 | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Softw… |
CVE-2019-13521 | High | 7.8 | 2020-01-27 | A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in t… |
CVE-2019-13519 | High | 7.8 | 2020-01-27 | A maliciously crafted program file opened by an unsuspecting user of Rockwell Automation Arena Simulation Software version 16.00.00 and earlier may result in t… |
CVE-2019-13527 | High | 7.8 | 2019-09-24 | In Rockwell Automation Arena Simulation Software Cat. 9502-Ax, Versions 16.00.00 and earlier, a maliciously crafted Arena file opened by an unsuspecting user m… |
CVE-2019-13511 | Low | 3.3 | 2019-08-15 | Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain an INFORMATION EXPOSURE CWE-200. A maliciously crafted Arena file opened by… |
CVE-2019-13510 | High | 7.8 | 2019-08-15 | Rockwell Automation Arena Simulation Software versions 16.00.00 and earlier contain a USE AFTER FREE CWE-416. A maliciously crafted Arena file opened by an uns… |
CVE-2019-10970 | Critical | 9.8 | 2019-07-11 | In Rockwell Automation PanelView 5510 (all versions manufactured before March 13, 2019 that have never been updated to v4.003, v5.002, or later), a remote, una… |
CVE-2019-10952 | Critical | 9.8 | 2019-05-01 | An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer ov… |
CVE-2019-10954 | High | 7.5 | 2019-05-01 | An attacker could send crafted SMTP packets to cause a denial-of-service condition where the controller enters a major non-recoverable faulted state (MNRF) in… |
CVE-2019-10955 | Medium | 6.1 | 2019-04-25 | In Rockwell Automation MicroLogix 1400 Controllers Series A, All Versions Series B, v15.002 and earlier, MicroLogix 1100 Controllers v14.00 and earlier, Compac… |
CVE-2018-19282 | Critical | 9.8 | 2019-04-04 | Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Industrial Protocol (C… |
CVE-2019-6553 | Critical | 9.8 | 2019-04-04 | A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior. An input validation issue in a .dll file of RSLinx Classic where th… |
CVE-2018-19016 | High | 7.5 | 2019-03-27 | Rockwell Automation EtherNet/IP Web Server Modules 1756-EWEB (includes 1756-EWEBK) Version 5.001 and earlier, and CompactLogix 1768-EWEB Version 2.005 and earl… |
CVE-2013-2805 | High | 7.5 | 2019-03-26 | Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not hand… |
CVE-2010-5305 | Critical | 9.8 | 2019-03-26 | The potential exists for exposure of the product's password used to restrict unauthorized access to Rockwell PLC5/SLC5/0x/RSLogix 1785-Lx and 1747-L5x controll… |
CVE-2013-2807 | High | 7.5 | 2019-03-26 | Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not hand… |
CVE-2013-2806 | High | 7.5 | 2019-03-26 | Rockwell Automation RSLinx Enterprise Software (LogReceiver.exe) CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not hand… |
CVE-2018-18981 | High | 7.5 | 2019-01-24 | In Rockwell Automation FactoryTalk Services Platform 2.90 and earlier, a remote unauthenticated attacker could send numerous crafted packets to service ports r… |
CVE-2018-19616 | High | 8.1 | 2018-12-26 | An issue was discovered in Rockwell Automation Allen-Bradley PowerMonitor 1000. An unauthenticated user can add/edit/remove administrators because access contr… |
CVE-2018-19615 | Medium | 6.1 | 2018-12-26 | Rockwell Automation Allen-Bradley PowerMonitor 1000 all versions. A remote attacker could inject arbitrary code into a targeted userâs web browser to gain ac… |
CVE-2018-17924 | High | 8.6 | 2018-12-07 | Rockwell Automation MicroLogix 1400 Controllers and 1756 ControlLogix Communications Modules An unauthenticated, remote threat actor could send a CIP connectio… |
CVE-2018-14829 | Critical | 9.8 | 2018-09-20 | Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote threat actor to intentionally send a malformed CIP packet… |
CVE-2018-14827 | High | 7.5 | 2018-09-20 | Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially crafted Ethernet/IP pack… |
CVE-2018-14821 | High | 7.5 | 2018-09-20 | Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intentionally send a malf… |
CVE-2017-9312 | High | 7.5 | 2018-06-25 | Improperly implemented option-field processing in the TCP/IP stack on Allen-Bradley L30ERMS safety devices v30 and earlier causes a denial of service. When a c… |
CVE-2018-10619 | High | 7.8 | 2018-06-07 | An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may allow an authorized… |
CVE-2017-12092 | Low | 3.7 | 2018-06-04 | An exploitable file write vulnerability exists in the memory module functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A specially cr… |
CVE-2018-8843 | Medium | 5.5 | 2018-05-14 | Rockwell Automation Arena versions 15.10.00 and prior contains a use after free vulnerability caused by processing specially crafted Arena Simulation Software… |
CVE-2017-6015 | High | 7.8 | 2018-05-11 | Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an a… |
CVE-2017-14473 | Critical | 10.0 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14472 | Critical | 10.0 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14471 | Critical | 10.0 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14470 | Critical | 10.0 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14469 | Critical | 10.0 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14468 | Critical | 9.8 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14467 | Critical | 9.8 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14466 | Critical | 9.8 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14465 | Critical | 9.8 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14464 | Critical | 9.8 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14463 | Critical | 9.8 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-14462 | Critical | 9.8 | 2018-04-05 | An exploitable access control vulnerability exists in the data, program, and function file permissions functionality of Allen Bradley Micrologix 1400 Series B… |
CVE-2017-12093 | Medium | 5.3 | 2018-04-05 | An exploitable insufficient resource pool vulnerability exists in the session communication functionality of Allen Bradley Micrologix 1400 Series B Firmware 21… |
CVE-2017-12090 | High | 7.7 | 2018-04-05 | An exploitable denial of service vulnerability exists in the processing of snmp-set commands of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below… |
CVE-2017-12089 | High | 8.6 | 2018-04-05 | An exploitable denial of service vulnerability exists in the program download functionality of Allen Bradley Micrologix 1400 Series B FRN 21.2 and before. A sp… |
CVE-2017-12088 | High | 8.6 | 2018-04-05 | An exploitable denial of service vulnerability exists in the Ethernet functionality of the Allen Bradley Micrologix 1400 Series B FRN 21.2 and below. A special… |
CVE-2018-0175 | High | 8.0 | 2018-03-28 | Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could… |
CVE-2018-0174 | High | 8.6 | 2018-03-28 | A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attack… |
CVE-2018-0173 | High | 8.6 | 2018-03-28 | A vulnerability in the Cisco IOS Software and Cisco IOS XE Software function that restores encapsulated option 82 information in DHCP Version 4 (DHCPv4) packet… |
CVE-2018-0172 | High | 8.6 | 2018-03-28 | A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attack… |
CVE-2018-0167 | High | 8.8 | 2018-03-28 | Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR S… |
CVE-2018-0163 | Medium | 6.5 | 2018-03-28 | A vulnerability in the 802.1x multiple-authentication (multi-auth) feature of Cisco IOS Software could allow an unauthenticated, adjacent attacker to bypass th… |
CVE-2018-0158 | High | 8.6 | 2018-03-28 | A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote at… |
CVE-2018-0155 | High | 8.6 | 2018-03-28 | A vulnerability in the Bidirectional Forwarding Detection (BFD) offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series… |
CVE-2017-16740 | Critical | 10.0 | 2018-01-09 | A Buffer Overflow issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers, Series B and C Versions 21.002 and earlier. The stack-… |
CVE-2017-14022 | High | 7.5 | 2017-12-23 | An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker w… |
CVE-2017-7924 | High | 7.5 | 2017-09-20 | An Improper Input Validation issue was discovered in Rockwell Automation MicroLogix 1100 controllers 1763-L16BWA, 1763-L16AWA, 1763-L16BBB, and 1763-L16DWD. A… |
CVE-2017-7903 | Critical | 9.8 | 2017-06-30 | A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and… |
CVE-2017-7902 | Critical | 9.8 | 2017-06-30 | A "Reusing a Nonce, Key Pair in Encryption" issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AW… |