CVE-2014-0755
Rockwell RSLogix 5000 Insufficiently Protected Credentials
02 Description
Rockwell RSLogix 5000 Insufficiently Protected Credentials
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.56% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 46.5% of scored records. A rank, not a probability.
- NVD base score
- The NVD has published no score for this record
- NVD CVSS vector
- No NVD score to derive
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2014-02-05 02:00Z12 YR AGO
- Last updated
- 2025-09-19 18:46Z1 YR AGO
- Reserved
- 2014-01-02
- Assigning CNA
- icscert
- Record state
- PUBLISHED
- Severity
- Not rated by the issuing CNA
- CNA CVSS vector
- Not published by the issuing CNA
- Weaknesses
- Data version
- 5.1
- Document digest
- c7a51f3d0987505244ac4b71168ed98a3132e2d8c57217dc26e9dbcb576fc24f
05 Affected products
06 References
- exchange.xforce.ibmcloud.comrslogix-cve20140755-info-disc(90981)https://exchange.xforce.ibmcloud.com/vulnerabilities/90981
- www.cisa.govhttps://www.cisa.gov/news-events/ics-advisories/icsa-14-021-01
- osvdb.org102858http://osvdb.org/102858
- www.securityfocus.com65337http://www.securityfocus.com/bid/65337
- rockwellautomation.custhelp.comhttps://rockwellautomation.custhelp.com/app/answers/detail/a_id/565204
- ics-cert.us-cert.govhttp://ics-cert.us-cert.gov/advisories/ICSA-14-021-01
07 Remediation
According to Rockwell Automation, new RSLogix 5000 versions, V20.03 and V21.03, have been released that address this vulnerability. These releases include mitigations that enhance password protection. Project files created in earlier affected RSLogix 5000 versions of software must be opened, resaved, and then downloaded to the appropriate controller to mitigate the risk associated with this discovered vulnerability. IMPORTANT: Files with protected content that have been opened and update using enhanced software will no longer be compatible with earlier versions of RSLogix 5000 software. For example, a V20.01 project file with protected content that has been opened and resaved using V20.03 software can only be opened with V20.03 and higher versions of software. Also, a V21.00 project file with protected content that has been opened and resaved using V21.03 software can only be opened with V21.03 and higher versions of software. For the procedure to update project files, please refer to Rockwell Automation Knowledgebase AID:565204 available here: https://rockwellautomation.custhelp.com/app/answers/detail/a_id/565204 . In addition to using current RSLogix 5000 software, Rockwell Automation also recommends the following actions to all concerned customers: * Where possible, adopt a practice to track creation and distribution of protected ACD files, including duplicates and derivatives that contain protected content in the event that these files may need to be found or