CVE-2022-2179 - ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames

Back Back to CVE browser

MEDIUM

ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames

Published Jul 20, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 1.68%

Description

The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.

Affected products

Vendor Rockwell Automation Product MicroLogix 1100 Default
n/a
- Version
  All versions
  Status
  affected
  Constraints
  -
Vendor Rockwell Automation Product MicroLogix 1400 Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=21.007

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rockwell Automation

MicroLogix 1100

n/a

Version	Status	Constraints
All versions	affected	-

Rockwell Automation

MicroLogix 1400

n/a

Version	Status	Constraints
unspecified	affected	<=21.007

Remediation

Vendor solution

Rockwell Automation encourages those using the affected software to implement the mitigations below to minimize risk. Additionally, Rockwell Automation encourages users to combine risk mitigations with security best practices (also provided below) to deploy a defense-in-depth strategy.

Disable the web server where possible (this component is an optional feature and disabling it will not disrupt the intended use of the device). Configure firewalls to disallow network communication through HTTP/Port 80

If applying the mitigations noted above are not possible, please see Rockwell Automation’s Knowledgebase article QA43240 Security Best Practices.

For more information, please see the industrial security advisory from Rockwell Automation.

Weaknesses (1)

CWE-1021

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34463
Advisory
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135994
x_refsource_CONFIRMPermissions RequiredVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-01
x_refsource_CONFIRMThird Party AdvisoryUS Government Resource

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-34463		Advisory
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135994		x_refsource_CONFIRMPermissions RequiredVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-01		x_refsource_CONFIRMThird Party AdvisoryUS Government Resource