Rockwell Automation flaw lets hackers access device without permission

TLDR:

• A critical security vulnerability in Rockwell Automation’s ControlLogix and GuardLogix controllers, identified as CVE-2024-6242, allows hackers to gain unauthorized access to industrial control systems.
• The flaw enables attackers to bypass security measures and send elevated commands to the PLC CPU, posing significant risks to industrial environments.

Researchers at Claroty’s Team82 uncovered the flaw, which affects various models of Rockwell’s 1756 ControlLogix devices. By exploiting this vulnerability, attackers can jump between local backplane slots within a chassis using CIP routing, potentially compromising the security boundary.

The affected products include ControlLogix 5580, GuardLogix 5580, and various models of 1756-EN2T, 1756-EN2F, 1756-EN2TR, and 1756-EN3TR. Rockwell Automation has released firmware updates to address the issue, urging users to update their devices to the latest versions.

Organizations using affected devices are advised to assess their risk exposure and implement necessary updates and mitigations to protect their systems from potential cyber attacks. This incident highlights the importance of robust security measures and continuous monitoring in operational technology environments to safeguard against threats targeting critical infrastructure.