spytbow
Junior
Joined: 27 Mar 2022
Posts: 2
|
 Posted: 07/04/2022 19:33 Post subject: Studio 5000 Logix Designer vulnerability |
 |
|
Studio 5000 Logix Designer vulnerability
https://isssource.com/rockwell-plan-for-studio-5000-logix-designer/
Rockwell Automation has a plan to handle a code injection vulnerability in its Studio 5000 Logix Designer, according to a report with CISA.
Successful exploitation of this vulnerability, discovered by Sharon Brizinov and Tal Keren of Claroty, may allow an attacker to download a modified program to the controller.
Rockwell Automation reports this vulnerability affects the following Studio 5000 Logix Designer design, configuration hardware, and software products:
ControlLogix 5580 controllers
GuardLogix 5580 controllers
CompactLogix 5380 controllers
CompactLogix 5480 controllers
Compact GuardLogix 5380 controllers
In the vulnerability, an attacker who achieves administrator access on a workstation running Studio 5000 Logix Designer could inject controller code undetectable to a user.
There is no direct mitigation for this vulnerability in the Logix Designer application. However, a detection method is available to determine if the user program residing in the controller is identical to what was downloaded.
This user program verification can be done by the following:
| Code: | On-demand using the Logix Designer application Compare Tool v9 or later
Scheduled using FactoryTalk AssetCentre v12 or later user program verification (Available Fall 2022)
To leverage these detection capabilities, users should upgrade to:
Studio 5000 v34 software or later
Corresponding versions of Logix 5580, 5380, 5480, GuardLogix 5580 and Compact GuardLogix 5380 controller firmware
One of the following compare tools
— Logix Designer application Compare Tool v9 or later – installed with Studio 5000 Logix Designer
— FactoryTalk AssetCentre v12 or later software (Available Fall 2022)
This user program comparison must be performed on an uncompromised workstation. |
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
