CVE-2022-2179
ICSA-22-188-01 Rockwell Automation MicroLogix Improper Restriction of Rendered UI Layers or Frames
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVDNVD · Modified | 3.1 | Medium6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
- EPSS (exploitation in 30 days)
- 1.7% · top 23% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.5.
Weakness
Affected products
Rockwell Automation · MicroLogix 1400
- affected unspecified – ≤ 21.007
Rockwell Automation · MicroLogix 1100
- affected All versions
What to do
Workaround: Rockwell Automation encourages those using the affected software to implement the mitigations below to minimize risk. Additionally, Rockwell Automation encourages users to combine risk mitigations with security best practices (also provided below) to deploy a defense-in-depth strategy. Disable the web server where possible (this component is an optional feature and disabling it will not disrupt the intended use of the device). Configure firewalls to disallow network communication through HTTP/Port 80 If applying the mitigations noted above are not possible, please see Rockwell Automation’s Knowledgebase article QA43240 Security Best Practices. For more information, please see the industrial security advisory from Rockwell Automation.
References (2)
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-01 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135994 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-2179)Record last updated .