Significant Vulnerability Discovered in Rockwell Automation Devices Allowing Unauthorized Entry
An elevated risk security loophole has been unveiled in Rockwell Automation ControlLogix 1756 devices providing the potential for unauthorized execution of typical industrial protocol (CIP) programming and configuration instructions.
The weakness, recognized with the CVE number CVE-2024-6242, has an 8.4 score on the CVSS v3.1 scale.
“The affected products host a vulnerability that permits a malicious entity to sidestep the Trusted Slot safeguard in a ControlLogix controller,” a statement from the U.S. Cybersecurity and Infrastructure Security Agency (CISA) explained.
“Upon exploitation on any affected module within a 1756 housing, an adversary could potentially trigger CIP instructions altering user projects and/or device configurations on a Logix controller within the unit.”
Claroty, an operational technology security firm that uncovered and reported the vulnerability, detailed the development of a method that enabled bypassing the trusted slot feature and transmitting malicious directives to the programming logic controller (PLC) CPU.
The trusted slot characteristic “enforces security policies and authorizes the controller to disallow communication through untrusted paths on the resident chassis,” shared security analyst Sharon Brizinov in a statement.
“The flaw we discovered, prior to its resolution, enabled an attacker to move between local backplane slots within a 1756 housing utilizing CIP routing, crossing the security boundary designed to safeguard the CPU from untrusted cards.”
Although a successful breach necessitates network connectivity to the device, an intruder could exploit the vulnerability to issue escalated orders, such as downloading arbitrary logic to the PLC CPU, even if positioned behind an untrusted network card.
Subsequent to a responsible disclosure, the deficiency has been remedied in the ensuing versions –
- ControlLogix 5580 (1756-L8z) – Update to versions V32.016, V33.015, V34.014, V35.011, and subsequent iterations.
- GuardLogix 5580 (1756-L8zS) – Update to versions V32.016, V33.015, V34.014, V35.011 and later.
- 1756-EN4TR – Update to versions V5.001 and beyond.
- 1756-EN2T Series D, 1756-EN2F Series C, 1756-EN2TR Series C, 1756-EN3TR Series B, and 1756-EN2TP Series A – Update to version V12.001 and later
“This vulnerability had the potential to expose critical control systems to unauthorized access over the CIP protocol that originated from untrusted chassis slots,” expressed Brizinov.
About Author
