Broken or risky cryptographic algorithm in Rockwell Automation MicroLogix 1400…
Priority MEDIUM 55CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-327.
Summary
Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior, The cryptographic function utilized to protect the password in MicroLogix is discoverable.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03877 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior | Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior | — | No fix listed | CNA |
- Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior Vendor— Affected Rockwell Automation MicroLogix 1400 Controllers Series B v21.001 and prior, Series A, all versions, MicroLogix 1100 Controller, all versions, RSLogix 500 Software v12.001 and prior Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:rockwellautomation:micrologix_1400_a_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Rockwell |
| cpe:2.3:o:rockwellautomation:micrologix_1400_b_firmware:*:*:*:*:*:*:*:* | up to 21.001 | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micrologix_1400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:micrologix_1100_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:micrologix_1100:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:a:rockwellautomation:rslogix_500:*:*:*:*:*:*:*:* | up to 12.001 | Vulnerable | Rockwell |
- cpe:2.3:o:rockwellautomation:micrologix_1400_a_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Rockwell
- cpe:2.3:o:rockwellautomation:micrologix_1400_b_firmware:*:*:*:*:*:*:*:* Versions up to 21.001 Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micrologix_1400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:micrologix_1100_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:micrologix_1100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:a:rockwellautomation:rslogix_500:*:*:*:*:*:*:*:* Versions up to 12.001 Vulnerable ·Rockwell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-6984
- 2026-10-03 Alias added: GHSA-f7cx-mjqx-2qmw
- 2026-10-30 EPSS moved to the 90th–95th percentile
References
More Rockwell Micrologix 1100 Firmware vulnerabilities
- TI-2015-05450 Stack-based buffer overflow on Allen-Bradley MicroLogix 1100 devices before B FRN 15.000… CVSS 3.1CRITICAL 9.8
- TI-2020-05638 Hard-coded credentials in Rockwell Automation MicroLogix 1400 Controllers Series B… CVSS 3.1CRITICAL 9.8
- TI-2021-12619 Improper input validation in Rockwell Automation MicroLogix 1100 CVSS 3.1HIGH 8.6
- TI-2015-05452 Allen-Bradley MicroLogix 1100 devices before B FRN 15.000 and 1400 devices before B FRN… CVSS 3.1HIGH 7.5
- TI-2020-05636 Improper authentication in Rockwell Automation MicroLogix 1400 Controllers Series B… CVSS 3.1HIGH 7.5
- TI-2022-02923 MicroLogix 1100 & 1400 Product Web Server Application Vulnerable to Denial-Of-Service Condition Attack CVSS 3.1HIGH 7.5
Sources
- CVE-2020-6984 · CVE Program
- CVE-2020-6984 · NVD
- FIRST EPSS
- GHSA-f7cx-mjqx-2qmw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences