Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

Cisco Finds 15 Vulnerabilities in AutomationDirect PLCs

Cisco Talos researchers have found over a dozen vulnerabilities in AutomationDirect PLCs, including flaws that could be valuable to attackers.

ICS vulnerabilities

Cisco’s Talos research and threat intelligence unit has discovered 15 vulnerabilities in programmable logic controllers (PLCs) made by US-based industrial automation products provider AutomationDirect.

The vulnerabilities impact AutomationDirect’s Productivity series PLCs. They have all been classified as having ‘high’ or ‘critical’ severity and they can be exploited for remote code execution or denial-of-service (DoS) attacks, which in general could have a significant impact in the case of industrial environments, as they can cause costly production disruptions. 

Yves Younan, senior manager at Talos Vulnerability Discovery and Research, told SecurityWeek that the impacted PLCs are typically not directly exposed to the internet, which means an attacker in most cases would need to establish a foothold in the targeted organization’s network before exploiting the vulnerabilities.

However, a Shodan search does show roughly 50 potential devices that may be directly connected to the internet.

“If this device were to be deployed under normal circumstances directly on the internet, then we would expect to get thousands of results,” Younan explained.

Learn more about industrial product vulnerabilities at 

SecurityWeek’s 2024 ICS Cyber Security Conference

Regarding the potential impact of these vulnerabilities in a real-world attack scenario, Younan pointed out that several of the flaws can be used — either on their own or chained with other security holes — for arbitrary code execution.

Advertisement. Scroll to continue reading.

“This would allow an attacker to perform any actions they like on this device, including manipulating the logic, shutting down the device or extracting information stored on the device,” the expert said. 

The US cybersecurity agency CISA, which informed organizations about these vulnerabilities in late May, says the impacted devices are used in the IT, commercial facilities and critical manufacturing sectors worldwide. 

Talos has published its own advisories for the AutomationDirect vulnerabilities discovered by its researchers. These advisories contain technical details for each issue. 

AutomationDirect was informed about the vulnerabilities in mid-February. The company has released firmware and programming software updates to address the flaws, and it has also shared some mitigations and general recommendations for securing systems. 

Related: Rockwell Automation Urges Customers to Disconnect ICS From Internet

Related: Cinterion Modem Flaws Pose Risk to Millions of Devices in Industrial, Other Sectors

Related: Critical Vulnerability in Honeywell Virtual Controller Allows Remote Code Execution

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders.

Register

People on the Move

Retired U.S. Army General and former NSA Director Paul M. Nakasone has joined the Board of Directors at OpenAI.

Jill Passalacqua has been appointed Chief Legal Officer at autonomous security solutions provider Horizon3.ai.

Cisco has appointed Sean Duca as CISO and Practice Leader for the APJC region.

More People On The Move

Expert Insights