CVE-2014-5410: Rockwell Automation Micrologix 1400 Improper Input Validation

Description

The DNP3 feature on Rockwell Automation Allen-Bradley MicroLogix 1400 1766-Lxxxxx A FRN controllers 7 and earlier and 1400 1766-Lxxxxx B FRN controllers before 15.001 allows remote attackers to cause a denial of service (process disruption) via malformed packets over (1) an Ethernet network or (2) a serial line.

Scores

CVSS scores of CVE-2014-5410, by who scored it
Scored by	CVSS	Score	Vector
icscertCNA (assigner)	2.0	High7.1	AV:N/AC:M/Au:N/C:N/I:N/A:C
NVDNVD · Modified	2.0	High7.1	AV:N/AC:M/Au:N/C:N/I:N/A:C

EPSS (exploitation in 30 days): 4.2% · top 9.1% of all CVEs (5 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

Affected products

Rockwell Automation · Allen-Bradley MicroLogix 1400
- affected ≤ 1766-Lxxxxx Series A FRN 7
- affected ≤ 1766-Lxxxxx Series B FRN 15.000
- unaffected Series B FRN 15.001 or higher

What to do

Solution: Rockwell Automation has released a new version of MicroLogix 1400 Series B firmware to address the vulnerability and reduce associated risk to successful exploitation. Subsequent versions of MicroLogix 1400 Series B firmware and newer will incorporate these same enhancements. Rockwell Automation recommends the following immediate mitigation strategies (when possible, multiple strategies should be employed simultaneously): * Upgrade all MicroLogix 1400 Series B controllers to Series B FRN 15.001 or higher. Current firmware for the MicroLogix 1400 Series B platform can be obtained at the following web address: http://www.rockwellautomation.com/rockwellautomation/support/pcdc.page Please refer to Rockwell Automation’s product disclosure (AID 620295) for more information on this topic available at: https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295

Workaround: Users with Series A and Series B controllers are also recommended to apply the following risk mitigations: * Do not enable DNP3 communication in the product unless required. * Where appropriate, prohibit DNP3 communication that originates outside the perimeter of the manufacturing zone from entry into the zone by blocking communication directed at Ethernet communication Port 20000/TCP* and 20000/UDP* using appropriate security technology (e.g., a firewall, UTM devices, or other security appliance) *Note: Ports 20000/TCP and 20000/UDP are factory defaults as per the DNP3 specification but can be reconfigured by the product owner. * Employ firewalls with ingress/egress filtering, intrusion detection/prevention systems, and validate all configurations. Evaluate firewall configurations to ensure other appropriate inbound and outbound traffic is blocked. * Restrict physical and electronic access to automation products, networks, and systems to only those individuals authorized to be in contact with control system equipment. * Employ layered security, defense-in-depth methods and network segregation and segmentation practices in system design to restrict and control access to individual products and control networks. Refer to http://www.ab.com/networks/architectures.html http://www.ab.com/networks/architectures.html%20 for comprehensive information about implementing validated architectures designed to deliver these measures. Please refer to Rockwell Automation’s product disclosure (AID 620295) for more information on this topic available at: https://rockwellautomation.custhelp.com/app/answers/detail/a_id/620295

References (4)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2014-5410](https://trackcve.app/badge/CVE-2014-5410.svg)](https://trackcve.app/cve/CVE-2014-5410)

Record last updated 4 Nov 2025, 22:30 UTC.