Security readout for executives and security teams
Plain-English summary
CVE-2017-14473 affects Allen Bradley MicroLogix 1400 Series B controllers at FRN 21.2 and earlier. An unauthenticated network attacker can read or write protected controller files, potentially exposing sensitive logic or changing settings and ladder logic. For industrial operations, this is a critical exposure if affected PLCs are reachable from untrusted networks.
Executive priority
Prioritize this as critical for any affected controller reachable beyond tightly controlled OT networks. The business risk is unauthorized disclosure or modification of PLC logic and settings, which can affect safety, uptime, and process integrity. Remediation should focus first on exposure reduction and vendor-approved firmware guidance.
Technical view
The issue is an access control failure in data, program, and function file permissions. The CVSS v3.0 score is 10.0, with network access, low complexity, no privileges, and no user interaction. The provided description says crafted packets can trigger read or write operations, including reading encoded ladder logic from a data file.
Likely exposure
Exposure is most likely where Allen Bradley MicroLogix 1400 Series B controllers running FRN 21.2 or earlier are network reachable. Highest concern is internet exposure, flat OT networks, remote access paths, or engineering networks where unauthenticated controller traffic can reach PLCs.
Exploitation context
The source bundle does not show CISA KEV listing or confirmed active exploitation. It does support unauthenticated remote triggering by specially crafted packets. Treat exploitation as plausible where network access exists, but do not claim observed attacks from these sources.
Researcher notes
Evidence is limited to the CVE bundle and Talos reference metadata supplied here. The record states unauthenticated packet-based read/write impact and a specific ladder-logic read behavior. It does not provide a named patch level, detailed mitigations, CWE mapping, or proof of active exploitation.
Mitigation direction
- Identify affected MicroLogix 1400 Series B firmware versions.
- Check Allen Bradley vendor guidance for fixed firmware or approved mitigations.
- Restrict controller access to trusted engineering hosts only.
- Segment PLC networks from IT, internet, and guest networks.
- Review controller logic and settings for unauthorized changes.
- Monitor for unexpected PLC file read or write activity.
Validation and detection
- Inventory MicroLogix 1400 Series B devices and FRN versions.
- Confirm whether FRN is 21.2 or earlier.
- Map all network paths that can reach affected controllers.
- Verify firewall rules block untrusted controller access.
- Compare ladder logic and settings against known-good baselines.
- Check change logs for unexplained configuration modifications.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-14473 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H3.96Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
10CriticalVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0443CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.