Critical Flaw in Rockwell Automation Devices Allows Unauthorized Access

Introduction

A high-severity security vulnerability has been identified in Rockwell Automation ControlLogix 1756 devices, which could be exploited to execute unauthorized industrial protocol (CIP) programming and configuration commands. This critical flaw, assigned CVE-2024–6242, has a CVSS v3.1 score of 8.4.

The Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an advisory regarding this vulnerability, stating: “A vulnerability exists in the affected products that allows a threat actor to bypass the Trusted Slot feature in a ControlLogix controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.”

Technical Details

Discovered by operational technology security company Claroty, the vulnerability allows attackers to bypass the trusted slot feature, which enforces security policies and denies communication via untrusted paths on the local chassis. Security researcher Sharon Brizinov from Claroty explained, “The vulnerability we found, before it was fixed, allowed an attacker to jump between local backplane slots within a 1756 chassis using CIP routing, traversing the security boundary meant to protect the CPU from untrusted cards.”