Rockwell Automation ControlLogix Flaws Expose ICS Devices to RCE & DoS Attacks

Rockwell Automation ControlLogix EtherNet/IP (ENIP) communication module models have two security issues that might be utilized to carry out remote code execution and cause a denial of service (DoS).

The ControlLogix system’s impacted communications modules are found in several industrial sectors, including manufacturing, electric, oil and gas, and liquified natural gas. They are also a component of the ControlLogix system.

Depending on how the ControlLogix system is configured, the outcomes and impact of exploiting these vulnerabilities vary.

Nevertheless, Dragos reported that they may result in denial or loss of control, denial or loss of view, theft of operational data, or manipulation of control with disruptive or harmful effects on the industrial process for which the ControlLogix system is responsible.

Flaws Identified

CVE-2023-3595 (CVSS score: 9.8):

It permits arbitrary firmware memory manipulation, which may result in loss of control, loss of vision, theft of operational data, and/or manipulation of control and view with disruptive or damaging effects.

This vulnerability exists in the Rockwell Automation ControlLogix communication products 1756 EN2* and 1756 EN3*.

CVE-2023-3596 (CVSS score: 7.5) :

A malicious user may be able to create a denial of service by asserting the target system using maliciously crafted CIP messages. This vulnerability exists in the Rockwell Automation 1756-EN4* Ethernet/IP communication products.

Impacted Products

Rockwell Automation ControlLogix 1756 EN2*, 1756 EN3*, and 1756 EN4* EtherNet/IP (ENIP) communication module series are affected by these flaws.

Additional ICS/OT effects would depend on how the ControlLogix system is configured and how the process is set up to operate.

The company says that the type of access made available by CVE-2023-3595 is comparable to that made available by XENOTIME’s zero-day in the TRISIS attack.

Both allow for arbitrary firmware memory manipulation, whereas CVE-2023-3595 specifically targets a communication module that processes network commands. Their combined effect is the same, though.

Industrial control systems (ICS) malware known as TRISIS, commonly referred to as TRITON, has been seen in the past attacking Triconex safety instrumented system (SIS) controllers from Schneider Electric that are utilized in oil and gas facilities.

“An unreleased exploit capability leveraging these vulnerabilities is associated with an unnamed APT (Advanced Persistent Threat) group”, Dragos said

“As of mid-July 2023, there was no evidence of exploitation in the wild and the targeted victim organizations and industry verticals were unknown”.

Recommended Read: Most Important Consideration for Industrial Control System(ICS) Cyber Defense

Recommendation

For all impacted products, including hardware models that were no longer supported, Rockwell Automation has released updates. Additionally, detection rules have been offered.

Update the firmware to the newest version. It is necessary to update the 1756-EN2* and EN3* models to at least version 11.004 or 5.029, depending on the series. Models of the 1756-EN4* will require a firmware update to version 5.002.

Defenders should understand what normal looks like in their ICS/OT settings and use ICS/OT protocol-aware technology to check for changes in network activity regularly.