16 CISA ICS advisories for Rockwell Automation in the last tracking window, 15 flagged as relevant to oil & gas. Newest first.
CISA reports 1 vulnerability in Rockwell Automation 1756-ENBT module. Weakness type: Improper Check for Unusual or Exceptional Conditions. Successful exploitation of this vulnerability could crash the module. The device requires a restart to recover. Highest CVSS v3 score: 7.5 (High), exploitable over the network.
CISA reports 2 vulnerabilities in Rockwell Automation ArmorStart LT. Weakness types: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Allocation of Resources Without Limits or Throttling. Successful exploitation of these vulnerabilities could result in a loss of webserver availabili…
CISA reports 1 vulnerability in Rockwell Automation ControlFLASH. Weakness type: Missing Authentication for Critical Function. Successful exploitation of this vulnerability could give an attacker the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission leve…
CISA reports 2 vulnerabilities in Rockwell Automation Series B, Series C. Weakness types: Out-of-bounds Write, Stack-based Buffer Overflow. Successful exploitation of these vulnerabilities could crash the device being accessed; an out-of-bounds write condition may allow remote code execution. Highest CVSS v3 score: 8.0…
CISA reports 1 vulnerability in Rockwell Automation ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380 and 1 more. Weakness type: Loop with Unreachable Exit Condition ('Infinite Loop'). Successful exploitation of this vulnerability could result in a major nonrecoverable fault (MNRF), requiri…
CISA reports 1 vulnerability in Rockwell Automation FactoryTalk Activation Manager. Weakness type: Improper Restriction of Excessive Authentication Attempts. Successful exploitation of this vulnerability could allow an authenticated attacker to obtain SYSTEM-level access, granting full control over all files, processes…
CISA reports 1 vulnerability in Rockwell Automation ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380. Weakness type: Improper Restriction of Operations within the Bounds of a Memory Buffer. Successful exploitation of this vulnerability could result in a major nonrecoverable fault (MNRF), r…
CISA reports 2 vulnerabilities in Rockwell Automation Redundancy Module Configuration Tool. Weakness type: Incorrect Default Permissions. Successful exploitation of these vulnerabilities could allow for an attacker to escalate and execute processes with administrator privileges. Highest CVSS v3 score: 7.3 (High), not r…
CISA reports 4 vulnerabilities in Rockwell Automation RSLinx Classic. Weakness types: Integer Overflow or Wraparound, Integer Underflow (Wrap or Wraparound), Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'). Successful exploitation of these vulnerabilities could allow an attacker to cause a denial…
CISA reports 1 vulnerability in Rockwell Automation OTTO Fleet Manager. Weakness type: Use of Password Hash With Insufficient Computational Effort. Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password ha…
CISA reports 1 vulnerability in Rockwell Automation ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380 and 1 more. Weakness type: Improper Check for Certificate Revocation. Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. Highest C…
CISA reports 1 vulnerability in Rockwell Automation ThinManager. Weakness type: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the app…
CISA reports 3 vulnerabilities in Rockwell Automation Studio 5000 Logix Designer. Weakness types: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Incorrect Authorization, Unquoted Search Path or Element. Successful exploitation of these vulnerabilities could allow for a local attacker to…
CISA reports 1 vulnerability in Rockwell Automation 1734 POINT I/O. Weakness type: Allocation of Resources Without Limits or Throttling. Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product. Highest CVSS v3 score: 3.7 (Low), exploitable over the…
CISA reports 1 vulnerability in Rockwell Automation 1718/ 1719 Ex I/O. Weakness type: Allocation of Resources Without Limits or Throttling. Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product. Highest CVSS v3 score: 7.5 (High), exploitable over…
CISA reports 1 vulnerability in Rockwell Automation FactoryTalk Directory (FTSP). Weakness type: Weak Authentication. Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations. Highest CVSS v3 sco…
Every week: the new ICS advisories that touch oil & gas gear, what they mean, and what to do. Free.
TODO: signup form not connected to a provider yet