A vulnerability affecting programmable logic controllers from Rockwell Automation can be exploited by attackers to gain control of affected devices. While the security hole is not easy to address, the vendor has provided some mitigation advice.
Researchers at Cisco Talos discovered that some Allen Bradley MicroLogix 1400 PLCs are exposed to attacks due to a flaw related to the Simple Network Management Protocol (SNMP), a network management protocol used for collecting information and configuring devices.
The problem uncovered by experts involves SNMP community strings. These community strings are similar to passwords and they allow or deny access to a device. The default community strings are usually “public,” which provides monitoring (read) capabilities, and “private,” which provides management (read/write) capabilities.
Cisco Talos researchers noticed that the Rockwell PLCs include an undocumented string named “wheel,” which provides both read and write capabilities. Attackers can abuse this string to make unauthorized changes to a device, including replace the original firmware with a malicious version.
Community strings can be changed by organizations. However, since this string is not documented, most users are likely unaware of its existence, leaving it open to abuse.
“Depending on the role of the affected PLC within an industrial control process, this could result in significant damages,” researchers warned.
The vulnerability has been assigned the identifier CVE-2016-5645 and a CVSS score of 7.3, which puts it in the high severity category. The list of affected products includes 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA and 1766-L32BXBA.
According to Rockwell Automation, the affected products rely on this SNMP feature for firmware updates, which prevents it from removing the capability. The company has advised customers to protect themselves against potential attacks by using the RUN keyswitch setting to prevent unauthorized firmware updates and configuration changes.
Another mitigation involves disabling the SNMP service and enabling it temporarily only when firmware upgrades are performed. Users have also been advised to use firewalls and minimize the exposure of the affected devices.
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
- New York Man Arrested for Running BreachForums Cybercrime Website
- Exploitation of Recent Fortinet Zero-Day Linked to Chinese Cyberspies
Latest News
- Backslash Snags $8M Seed Financing for AppSec Tech
- ‘Badsecrets’ Open Source Tool Detects Secrets in Many Web Frameworks
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- Chrome 111 Update Patches High-Severity Vulnerabilities
- BreachForums Shut Down Over Law Enforcement Takeover Concerns
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Malware Trends: What’s Old Is Still New
- Burnout in Cybersecurity – Can It Be Prevented?
