—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3937
ICS Advisory | ICSA-23-193-01 Rockwell Automation Select
Communication Modules
13 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: Rockwell Automation Select Communication Modules
Publisher: ICS-CERT
Operating System: Network Appliance
Resolution: Patch/Upgrade
CVE Names: CVE-2023-3596 CVE-2023-3595
Original Bulletin:
https://www.cisa.gov/news-events/ics-advisories/icsa-23-193-01
Comment: CVSS (Max): 9.8 CVE-2023-3595 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVSS Source: ICS-CERT
Calculator: https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
– ————————–BEGIN INCLUDED TEXT——————–
ICS Advisory (ICSA-23-193-01)
Rockwell Automation Select Communication Modules
Release Date
July 12, 2023
1. EXECUTIVE SUMMARY
o CVSS v3 9.8
o ATTENTION: Exploitable remotely/low attack complexity
o Vendor: Rockwell Automation
o Equipment: 1756-EN2T, 1756-EN2TK, 1756-EN2TXT, 1756-EN2TP, 1756-EN2TPK,
1756-EN2TPXT, 1756-EN2TR, 1756-EN2TRK, 1756-EN2TRXT, 1756-EN2F, 1756-EN2FK,
1756-EN3TR, 1756-EN3TRK, 1756-EN4TR, 1756-EN4TRK, 1756-EN4TRXT
o Vulnerabilities: Out-of-bounds Write
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could allow malicious actors
to gain remote access of the running memory of the module and perform malicious
activity.
3. TECHNICAL DETAILS
3.1 AFFECTED PRODUCTS
The following Rockwell Automation products are affected:
o 1756-EN2T Series A, B, and C: Versions 5.008 and 5.028 and prior
o 1756-EN2T Series D: Versions 11.003 and prior
o 1756-EN2TK Series A, B, and C: Versions 5.008 and 5.028 and prior
o 1756-EN2TK Series D: Versions 11.003 and prior
o 1756-EN2TXT Series A, B, and C: Versions 5.008 and 5.028 and prior
o 1756-EN2TXT Series D: Versions 11.003 and prior
o 1756-EN2TP Series A: Versions 11.003 and prior
o 1756-EN2TPK Series A: Versions 11.003 and prior
o 1756-EN2TPXT Series A: Versions 11.003 and prior
o 1756-EN2TR Series A and B: Versions 5.008 and 5.028 and prior
o 1756-EN2TR Series C: Versions 11.003 and prior
o 1756-EN2TRK Series A and B: Versions 5.008 and 5.028 and prior
o 1756-EN2TRK Series C: Versions 11.003 and prior
o 1756-EN2TRXT Series A and B: Versions 5.008 and 5.028 and prior
o 1756-EN2TRXT Series C: Versions 11.003 and prior
o 1756-EN2F Series A and B: Versions 5.008 and 5.028 and prior
o 1756-EN2F Series C: Versions 11.003 and prior
o 1756-EN2FK Series A and B: Versions 5.008 and 5.028 and prior
o 1756-EN2FK Series C: Versions 11.003 and prior
o 1756-EN3TR Series A: Versions 5.008 and 5.028 and prior
o 1756-EN3TR Series B: Versions 11.003 and prior
o 1756-EN3TRK Series A: Versions 5.008 and 5.028 and prior
o 1756-EN3TRK Series B: Versions 11.003 and prior
o 1756-EN4TR Series A: Versions 5.001 and prior
o 1756-EN4TRK Series A: Versions 5.001 and prior
o 1756-EN4TRXT Series A: Versions 5.001 and prior
3.2 VULNERABILITY OVERVIEW
3.2.1 OUT-OF-BOUNDS WRITE CWE-787
Where this vulnerability exists in the 1756 EN2* and 1756 EN3* products, it
could allow a malicious user to perform remote code execution with persistence
on the target system through maliciously crafted CIP messages. This includes
the ability to modify, deny, and exfiltrate data passing through the device.
CVE-2023-3595 has been assigned to this vulnerability. A CVSS v3 base score of
9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:H/I:H/A:H ).
3.2.2 OUT-OF-BOUNDS WRITE CWE-787
Where this vulnerability exists in the 1756-EN4* products, it could allow a
malicious user to cause a denial-of-service condition by asserting the target
system through maliciously crafted CIP messages.
CVE-2023-3596 has been assigned to this vulnerability. A CVSS v3 base score of
7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/
C:N/I:N/A:H ).
3.3 BACKGROUND
o CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
o COUNTRIES/AREAS DEPLOYED: Worldwide
o COMPANY HEADQUARTERS LOCATION: United States
3.4 RESEARCHER
Rockwell Automation reported these vulnerabilities to CISA.
4. MITIGATIONS
Rockwell Automation has released the following versions to fix these
vulnerabilities and can be addressed by performing a standard firmware update.
Customers are strongly encouraged to implement the risk mitigations provided
below and to the extent possible, to combine these with the security best
practices to employ multiple strategies simultaneously.
o 1756-EN2T Series A, B, and C: Update to 5.029 or later signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN2T Series D: Update to 11.004 or later
o 1756-EN2TK Series A, B, and C: Update to 5.029 or later signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN2TK Series D: Update to 11.004 or later
o 1756-EN2TXT Series A, B, and C: Update to 5.029 or later signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN2TXT Series D: Update to 11.004 or later
o 1756-EN2TP Series A: Update to 11.004 or later
o 1756-EN2TPK Series A: Update to 11.004 or later
o 1756-EN2TPXT Series A: Update to 11.004 or later
o 1756-EN2TR Series A and B: Update to 5.029 or later for signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN2TR Series C: Update to 11.004 or later
o 1756-EN2TRK Series A and B: Update to 5.029 or later for signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN2TRK Series C: Update to 11.004 or later
o 1756-EN2TRXT Series A and B: Update to 5.029 or later for signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN2TRXT Series C: Update to 11.004 or later
o 1756-EN2F Series A and B: Update to 5.029 or later for signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN2F Series C: Update to 11.004 or later
o 1756-EN2FK Series A and B: Update to 5.029 or later for signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN2FK Series C: Update to 11.004 or later
o 1756-EN3TR Series A: Update to 5.029 or later for signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN3TR Series B: Update to 11.004 or later
o 1756-EN3TRK Series A: Update to 5.029 or later for signed versions
(**recommended). Update to 5.009 for unsigned versions
o 1756-EN3TRK Series B: Update to 11.004 or later
o 1756-EN4TR Series A: Update to 5.002 or later
o 1756-EN4TRK Series A: Update to 5.002 or later
o 1756-EN4TRXT Series A: Update to 5.002 or later
** Rockwell Automation strongly recommends updating to signed firmware if
possible. Once the module is updated to signed firmware (example 5.008 to
5.0029), it is not possible to revert to unsigned firmware versions.
Organizations should take the following actions to further secure ControlLogix
communications modules from exploitation:
o Update firmware. Update EN2* ControlLogix communications modules to
firmware revision 11.004 and update EN4* ControlLogix communications
modules to firmware revision 5.002.
o Properly segment networks. Given a cyber actor would require network
connectivity to the communication module to exploit the vulnerability,
organizations should ensure ICS/SCADA networks are properly segmented
within the process structure as well as from the Internet and other
non-essential networks.
o Implement detection signatures. Use appended Snort signatures to monitor
and detect anomalous Common Industrial Protocol (CIP) packets to Rockwell
Automation devices.
For more information and to see Rockwell’s detection rules, see Rockwell
Automation’s Security Advisory .
CISA reminds organizations to perform proper impact analysis and risk
assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices
on the ICS webpage at cisa.gov/ics . Several CISA products detailing cyber
defense best practices are available for reading and download, including
Improving Industrial Control Systems Cybersecurity with Defense-in-Depth
Strategies .
Additional mitigation guidance and recommended practices are publicly available
on the ICS webpage at cisa.gov/ics in the technical information paper,
ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation
Strategies .
Organizations observing suspected malicious activity should follow established
internal procedures and report findings to CISA for tracking and correlation
against other incidents.
No known public exploits specifically target these vulnerabilities.
This product is provided subject to this Notification and this Privacy & Use
policy.
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZK+N3MkNZI30y1K9AQhHaQ//ab8iQa/SqiI71sy+ypOHwl0U6ZG3qU14
/03HFitfhPZarSSwAlnlE6YCe/QNUkbJJITdrrk53OE1ZaMr+eeadkb6b0S4+Zfq
gcbvQbRCXi1uAwO78mZgBpcNwa2+534gwdEcP+6opqmXij34jTY8x9KcjF59WBbY
A352RKwujKKDwyePxtIsU3JIRNzfTDCcvAC7cpXaiTMz+jqLSHkUfoiPbV1tX1Yb
X33pfmAPFI+A2OotfBs35sY9JmVZXgfyF3AOM1C1EI90nGhjmjQkR3naGbh2jvbi
k7CwRrzyF6KMM50BSgx8nD7/oD0rhMY6TXASbqbRBPmAwHZ9umqD3QPPBnPi7bqg
RDLDbGGqS9+TsgIrKWati7S5oMZ3GvwIPMSpydx36PoUpXoCTB6cjT2cTLJNoXDr
H3CyJ4Yg8m/8HDa7DSAUQM1fXvCqwwJM5R2Fqgp3vEaPIpBGWyaNFLOlHMG6RcCv
9+UBoJ87q6Eg/HF4hd2k59xgzAvwWatCy4kowHMCVtvojisyCVKS3u2I9NANaJLq
LbPle/QBJoIpASJfH0YNSVk1sEJMo2hSEIKmMFAJnOk4w1KJa06z/En4M2c6VrI6
12EBpmwzTua3Itctc4pQ/Gh4x6lgCJaUJ/xrQKcud1vnrQnu4Syl6rRoAwQ3ZZzc
XfRtsPT/20w=
=EBh/
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins