Rockwell RSLogix 5000 Password Vulnerability

Vulnerabilities 1

• Medium 6.3
  CVE-2014-0755

  Rockwell RSLogix 5000 Insufficiently Protected Credentials

  Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors.

  Rockwell Automation RSLogix 5000 software ICS / OT
  Feb 5, 2014

Revision history

1. 2025-06-09 #2

   Advisory converted into a CSAF

2. 2014-10-24 #1

   Initial Publication

References

• ICS Advisory ICSA-14-021-01 - Web Version
  https://www.cisa.gov/news-events/ics-advisories/icsa-14-021-01
• Recommended Practices
  https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
• Recommended Practices
  https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
• Recommended Practices
  https://www.cisa.gov/topics/industrial-control-systems
• Recommended Practices
  https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
• Recommended Practices
  https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
• Recommended Practices
  https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
• Recommended Practices
  https://www.cisa.gov/uscert/ncas/tips/ST04-014