A vulnerability affecting programmable logic controllers from Rockwell Automation can be exploited by attackers to gain control of affected devices. While the security hole is not easy to address, the vendor has provided some mitigation advice.
Researchers at Cisco Talos discovered that some Allen Bradley MicroLogix 1400 PLCs are exposed to attacks due to a flaw related to the Simple Network Management Protocol (SNMP), a network management protocol used for collecting information and configuring devices.
The problem uncovered by experts involves SNMP community strings. These community strings are similar to passwords and they allow or deny access to a device. The default community strings are usually “public,” which provides monitoring (read) capabilities, and “private,” which provides management (read/write) capabilities.
Cisco Talos researchers noticed that the Rockwell PLCs include an undocumented string named “wheel,” which provides both read and write capabilities. Attackers can abuse this string to make unauthorized changes to a device, including replace the original firmware with a malicious version.
Community strings can be changed by organizations. However, since this string is not documented, most users are likely unaware of its existence, leaving it open to abuse.
“Depending on the role of the affected PLC within an industrial control process, this could result in significant damages,” researchers warned.
The vulnerability has been assigned the identifier CVE-2016-5645 and a CVSS score of 7.3, which puts it in the high severity category. The list of affected products includes 1766-L32BWA, 1766-L32AWA, 1766-L32BXB, 1766-L32BWAA, 1766-L32AWAA and 1766-L32BXBA.
According to Rockwell Automation, the affected products rely on this SNMP feature for firmware updates, which prevents it from removing the capability. The company has advised customers to protect themselves against potential attacks by using the RUN keyswitch setting to prevent unauthorized firmware updates and configuration changes.
Another mitigation involves disabling the SNMP service and enabling it temporarily only when firmware upgrades are performed. Users have also been advised to use firewalls and minimize the exposure of the affected devices.