Rockwell Automation Patches Vulnerabilities in ICS Products
Summary
Rockwell patched vulnerabilities across its ICS controllers and software, including flaws that could enable denial of service, authentication bypass, privileged operations, or account takeover. The company said none of the newly patched flaws had been targeted.
Key points
- FactoryTalk Historian Site Edition had three high- or critical-severity flaws that could enable authentication bypass or denial-of-service attacks.
- An improper API authorization flaw in FactoryTalk Analytics PavilionX could allow unauthorized privileged operations, including user and role management.
- Several CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix controllers had denial-of-service flaws; some CompactLogix models had two additional DoS issues.
- Flex I/O dual-port Ethernet/IP adapters had a DoS flaw and a critical unauthenticated password-change vulnerability that could lead to unauthorized access and account takeover.
- Rockwell also patched a legacy denial-of-service vulnerability in RSLinx involving a third-party component.
- CISA distributed Rockwell’s ICS advisories but did not publish an advisory for the FactoryTalk Historian vulnerabilities.
- Rockwell said none of the newly patched vulnerabilities had been exploited; it had recently confirmed in-the-wild exploitation of the older CVE-2021-22681.
Article Details
- Vulnerability Types
- Authentication bypass
- Denial of service
- Improper API authorization
- Unauthorized web interface password change
- Severity
- High and critical
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
Vendors
Products
Compact GuardLogixIn some of its CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix controllers, the vendor fixed a high-severity DoS vulnerability that can cause a major, non-recoverable fault requiring a special recoveryCompactLogixcustomers on Tuesday that patches are available for several vulnerabilities affecting its Logix and CompactLogix controllers, Flex I/O dual-port Ethernet/IP adapters, RSLinx industrial communication software, andControlLogixIn some of its CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix controllers, the vendor fixed a high-severity DoS vulnerability that can cause a major, non-recoverable fault requiring a special recoveryFactoryTalkcontrollers, Flex I/O dual-port Ethernet/IP adapters, RSLinx industrial communication software, and FactoryTalk automation suite.FactoryTalk Analytics PavilionXThe company told customers that its FactoryTalk Analytics PavilionX product is affected by a high-severity improper API authorization issue that “can allow an unauthorized actor to execute privileged operations,FactoryTalk Historian Site EditionIn FactoryTalk Historian Site Edition the industrial giant patched three high- and critical-severity vulnerabilities that can be exploited to bypass authentication and launch DoS attacks.Flex I/O dual-port Ethernet/IP adaptersavailable for several vulnerabilities affecting its Logix and CompactLogix controllers, Flex I/O dual-port Ethernet/IP adapters, RSLinx industrial communication software, and FactoryTalk automation suite.GuardLogixIn some of its CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix controllers, the vendor fixed a high-severity DoS vulnerability that can cause a major, non-recoverable fault requiring a special recoveryLogixinformed customers on Tuesday that patches are available for several vulnerabilities affecting its Logix and CompactLogix controllers, Flex I/O dual-port Ethernet/IP adapters, RSLinx industrial communicationRSLinxaffecting its Logix and CompactLogix controllers, Flex I/O dual-port Ethernet/IP adapters, RSLinx industrial communication software, and FactoryTalk automation suite.