Team82 Research
The Claroty Research Team has discovered a severe vulnerability (CVE-2021-22681, CVSS 10.0) in a mechanism that verifies communication between Rockwell Automation PLCs and engineering stations. The vulnerability affects Studio 5000 Logix Designer, RSLogix 5000, and many Logix Controllers.
Exploiting this flaw enables an attacker to remotely connect to almost any of the company's Logix programmable logic controllers (PLCs), and upload malicious code, download information from the PLC, or install new firmware.
The vulnerability lies in the fact that Studio 5000 Logix Designer software may allow a secret cryptographic key to be discovered. This key is used to verify communication between Rockwell Logix controllers and their engineering stations. If successfully exploited, this vulnerability could allow a remote, unauthenticated attacker to bypass this verification mechanism and connect to Logix controllers.
An attacker who is able to extract the secret key would be able to authenticate to any Rockwell Logix controller. These secret keys digitally sign all communication with the Rockwell PLCs; the PLCs verify the signature and authorize communication between it and the Rockwell engineering software. An attacker with this key could mimic a workstation and therefore be able to manipulate configurations or code running on the PLC (upload/download logic), and directly impact a manufacturing process.
Affected versions include: Rockwell's Studio 5000 Logix Designer (versions 21 and later) and RSLogix 5000 (versions 16-20), as well as Rockwell Logix Controllers (CompactLogix 1768, 1769, 5370, 5380, 5480, 5550, 5560, 5570, 5580), Drive Logix (5560, 5730, 1794-L34), Compact GuardLogix (5370 and 5380), GuardLogix (5570 and 5580), and SoftLogix 5800.
An advisory published Thursday by the Industrial Control System Cyber Emergency Response Team (ICS-CERT), describes the vulnerability as requiring low skill level to exploit.
Claroty privately disclosed the flaw to Rockwell in 2019; researchers from South Korea's Soonchunhyang University's Lab of Information Systems Security Assurance, and Kaspersky Lab, were also credited by ICS-CERT as having independently discovered the vulnerability.
Rockwell Automation recommends a number of specific mitigations including putting the controller's mode switch to "Run" mode and deploying CIP Security for Logix Designer connections. CIP Security prevents unauthorized connections when deployed properly.
Rockwell Automation also recommends a number of generic mitigations to blunt the effects of this vulnerability, starting with proper network segmentation and security controls such as minimizing exposure of control systems to the network or the internet. Control systems, Rockwell said, should be behind firewalls and isolated from other networks whenever feasible. Secure remote access is also suggested; at a minimum, using a VPN to connect to a device.
The ICS-CERT advisory includes all Rockwell mitigation advice, including a number of recommendations for each product family and version. It also recommends a number of detection methods if users suspect configurations have been modified. Those include:
Monitor controller change log for any unexpected modifications or anomalous activity.
If using v17 or later, utilize the Controller Log feature.
If using v20 or later, utilize Change Detection in the Logix Designer Application.
If available, use the functionality in FactoryTalk AssetCentre to detect changes.
An exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to obtain sensitive information via unspecified vectors.
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Synology RT6600ax routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the info.cgi file. The issue results from the exposure of sensitive data to the WAN interface. An attacker can leverage this vulnerability to disclose certain information in the context of the current process.
CVSS V3: 5.3
An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote attackers to read specific files via unspecified vectors.
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Synology RT6600ax routers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the uistrings.cgi file. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of the current process.
CVSS V3: 5.3
An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology RT6600ax routers. Authentication is required to exploit this vulnerability.
The specific flaw exists within the WEB API endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.
CVSS V3: 7.2
An uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to conduct denial-of-service attacks via unspecified vectors.
This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Synology RT6600ax routers. Authentication is required to exploit this vulnerability.
The specific flaw exists within the SYNO.Core file. The issue results from uncontrolled resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the device.
CVSS V3: 4.9
CWE-256: Plaintext Storage of a Password
The affected product stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate user’s credentials.
Softneta recommends users update to v7.2.9.820 of MedDream PACS Server or patch their current system using Fix-v230712.
CVSS V3: 6.1