Security readout for executives and security teams
Plain-English summary
This flaw affects Allen Bradley MicroLogix 1400 Series B controllers running FRN 21.2 or earlier. A remote unauthenticated attacker could read the master password or modify controller settings or ladder logic. For an organization using these controllers, the business risk is loss of confidentiality and integrity in operational equipment.
Executive priority
Treat this as urgent for any environment still running affected controllers. Prioritize discovery, segmentation, vendor guidance review, and integrity checks before routine IT vulnerabilities, because successful abuse could affect operational logic and sensitive controller data.
Technical view
CVE-2017-14472 is an access-control weakness in data, program, and function file permissions. The CVE describes specially crafted unauthenticated network packets causing read or write operations. The specific described behavior returns the ASCII version of the master password from an undocumented data file. CVSS v3.0 is 10.0.
Likely exposure
Exposure is most likely where Allen Bradley MicroLogix 1400 Series B controllers with FRN 21.2, 21.0, 15, or earlier are network-reachable. The CVE says the keyswitch state can be any state, so relying on physical mode position alone is not a sufficient control.
Exploitation context
The bundle does not show CISA KEV listing or another cited source confirming active exploitation. However, the issue is remotely reachable, unauthenticated, low complexity, and affects operational controllers, making exposed or poorly segmented deployments high priority for assessment.
Researcher notes
The provided evidence identifies impact and affected firmware but does not include a vendor patch statement, CISA KEV entry, exploit-in-the-wild confirmation, or protocol-level safe test procedure. Avoid active probing without an approved industrial-control testing plan.
Mitigation direction
- Inventory MicroLogix 1400 Series B controllers and firmware revisions.
- Check Rockwell or Allen-Bradley guidance for fixed firmware or compensating controls.
- Restrict network access to controllers to explicitly trusted engineering hosts.
- Use industrial firewall rules to limit unauthenticated controller traffic paths.
- Monitor controller settings and ladder logic for unexpected changes.
Validation and detection
- Confirm whether any MicroLogix 1400 Series B controller runs FRN 21.2 or earlier.
- Review network segmentation for routes from untrusted networks to affected controllers.
- Compare current ladder logic and settings against known-good backups.
- Check security monitoring for unexpected read, write, or program-change activity.
- Document any unsupported or unpatched controllers requiring compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-14472 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
10CriticalVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0443CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.