SB2021030105 - Insufficiently protected credentials in Rockwell Automation Logix Controllers

Description

This security bulletin contains information about 1 security vulnerability.

1) Insufficiently protected credentials (CVE-ID: CVE-2021-22681)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected product uses a key to verify Logix controllers are communicating with the affected Rockwell Automation products. A remote attacker can bypass this verification mechanism and authenticate with Logix controllers.

This vulnerability affects the following Rockwell Logix Controllers:

• CompactLogix 1768
• CompactLogix 1769
• CompactLogix 5370
• CompactLogix 5380
• CompactLogix 5480
• ControlLogix 5550
• ControlLogix 5560
• ControlLogix 5570
• ControlLogix 5580
• DriveLogix 5560
• DriveLogix 5730
• DriveLogix 1794-L34
• Compact GuardLogix 5370
• Compact GuardLogix 5380
• GuardLogix 5570
• GuardLogix 5580
• SoftLogix 5800

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://ics-cert.us-cert.gov/advisories/icsa-21-056-03
• https://ics-cert.kaspersky.com/advisories/klcert-advisories/2021/03/02/klcert-17-029-authentication-bypass-in-rockwell-automation-logix-controllers
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130301