Saturday, December 9, 2023

Rockwell Automation ControlLogix Flaws Expose ICS Devices to RCE & DoS Attacks

Rockwell Automation ControlLogix EtherNet/IP (ENIP) communication module models have two security issues that might be utilized to carry out remote code execution and cause a denial of service (DoS).

The ControlLogix system’s impacted communications modules are found in several industrial sectors, including manufacturing, electric, oil and gas, and liquified natural gas. They are also a component of the ControlLogix system.

Depending on how the ControlLogix system is configured, the outcomes and impact of exploiting these vulnerabilities vary.

Nevertheless, Dragos reported that they may result in denial or loss of control, denial or loss of view, theft of operational data, or manipulation of control with disruptive or harmful effects on the industrial process for which the ControlLogix system is responsible.

Flaws Identified

CVE-2023-3595 (CVSS score: 9.8):

It permits arbitrary firmware memory manipulation, which may result in loss of control, loss of vision, theft of operational data, and/or manipulation of control and view with disruptive or damaging effects.

This vulnerability exists in the Rockwell Automation ControlLogix communication products 1756 EN2* and 1756 EN3*.

CVE-2023-3596 (CVSS score: 7.5) :

A malicious user may be able to create a denial of service by asserting the target system using maliciously crafted CIP messages. This vulnerability exists in the Rockwell Automation 1756-EN4* Ethernet/IP communication products.

Impacted Products

Rockwell Automation ControlLogix 1756 EN2*, 1756 EN3*, and 1756 EN4* EtherNet/IP (ENIP) communication module series are affected by these flaws.

Additional ICS/OT effects would depend on how the ControlLogix system is configured and how the process is set up to operate.

The company says that the type of access made available by CVE-2023-3595 is comparable to that made available by XENOTIME’s zero-day in the TRISIS attack.

Both allow for arbitrary firmware memory manipulation, whereas CVE-2023-3595 specifically targets a communication module that processes network commands. Their combined effect is the same, though.

Industrial control systems (ICS) malware known as TRISIS, commonly referred to as TRITON, has been seen in the past attacking Triconex safety instrumented system (SIS) controllers from Schneider Electric that are utilized in oil and gas facilities.

“An unreleased exploit capability leveraging these vulnerabilities is associated with an unnamed APT (Advanced Persistent Threat) group”, Dragos said

“As of mid-July 2023, there was no evidence of exploitation in the wild and the targeted victim organizations and industry verticals were unknown”.

Recommended Read: Most Important Consideration for Industrial Control System(ICS) Cyber Defense


For all impacted products, including hardware models that were no longer supported, Rockwell Automation has released updates. Additionally, detection rules have been offered.

Update the firmware to the newest version. It is necessary to update the 1756-EN2* and EN3* models to at least version 11.004 or 5.029, depending on the series. Models of the 1756-EN4* will require a firmware update to version 5.002.

Defenders should understand what normal looks like in their ICS/OT settings and use ICS/OT protocol-aware technology to check for changes in network activity regularly.


Latest articles

WordPress POP Chain Flaw Exposes Over 800M+ Websites to Attack

A critical remote code execution vulnerability has been patched as part of the Wordpress...

Russian Star Blizzard New Evasion Techniques to Hijack Email Accounts

Hackers target email accounts because they contain valuable personal and financial information. Successful email...

Exploitation Methods Used by PlugX Malware Revealed by Splunk Research

PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid...

TA422 Hackers Attack Organizations Using Outlook & WinRAR Vulnerabilities

Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative...

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...

Endpoint Strategies for 2024 and beyond

Converge and Defend

What's the pulse of Unified Endpoint Management and Security (UEMS) in Europe? Join us live to uncover the strategies that are defining endpoint security in the region.

Related Articles