{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Eunseon Jeong",
          "Youngho An",
          "Junyoung Park",
          "Insu Oh",
          "Kangbin Yim"
        ],
        "organization": "Lab of Information Systems Security Assurance of Soonchunhyang University",
        "summary": "independently discovering this vulnerability"
      },
      {
        "organization": "Kaspersky",
        "summary": "independently discovering this vulnerability"
      },
      {
        "names": [
          "Sharon Brizinov",
          "Tal Keren"
        ],
        "organization": "Claroty",
        "summary": "independently discovering this vulnerability"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to bypass the verification mechanism and connect with Logix controllers. Additionally, this vulnerability could enable an unauthorized third-party tool to alter the controller \u0027s configuration and/or application code.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage onus-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target this vulnerability.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-056-03 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-056-03.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-21-056-03 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Rockwell Automation Logix Controllers (Update A)",
    "tracking": {
      "current_release_date": "2021-03-18T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-21-056-03",
      "initial_release_date": "2021-02-25T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2021-02-25T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-21-056-03 Rockwell Automation Logix Controllers"
        },
        {
          "date": "2021-03-18T00:00:00.000000Z",
          "legacy_version": "A",
          "number": "2",
          "summary": "ICSA-21-056-03 Rockwell Automation Logix Controllers (Update A)"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "16 \u003c= 20",
                "product": {
                  "name": "RSLogix 5000: Versions 16 through 20",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "RSLogix 5000"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e= 21",
                "product": {
                  "name": "Studio 5000 Logix Designer: Versions 21 and later",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Studio 5000 Logix Designer"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003e= 2.10",
                "product": {
                  "name": "FactoryTalk Security part of the FactoryTalk Services Platform if configured and deployed: v2.10 and later",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "FactoryTalk Security part of the FactoryTalk Services Platform if configured and deployed"
          }
        ],
        "category": "vendor",
        "name": "Rockwell Automation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-22681",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Studio 5000 Logix Designer uses a key to verify Logix controllers are communicating with the affected Rockwell Automation products. The product is vulnerable because an unauthenticated attacker could bypass this verification mechanism and authenticate with Logix controllers.CVE-2021-22681 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-22681"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Rockwell Automation has determined this vulnerability cannot be mitigated with a patch. Rockwell encourages users to combine its specific risk mitigation recommendations with general security guidelines for a comprehensive defense-in-depth strategy.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "A comprehensive defense-in-depth strategy can reduce the risk of this vulnerability. To reduce risk, Rockwell recommends users ensure they are employing proper network segmentation and security controls",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimizing network exposure for all control system devices and/or systems and confirm these devices are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Locating control system networks and devices behind firewalls and isolating them from the enterprise/business network.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Restricting or blocking traffic on TCP 44818 from outside of the industrial control system network zone. For more information on the TCP/UDP ports used by Rockwell Automation products, see BF7490 (login required).",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://idp.rockwellautomation.com/adfs/ls/idpinitiatedsignon.aspx?RelayState=RPID%3Drockwellautomation.custhelp.com%26RelayState%3Danswers%2Fanswer_view%2Fa_id%2F898270"
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. VPN is only as secure as the connected devices.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Users should refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices for deploying network segmentation, as well as broader defense-in-depth strategies. Users can also refer to Rockwell Automation\u0027s System Security Design Guidelines on how to use Rockwell Automation products to improve the security of industrial automation systems.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td001_-en-p.pdf"
        },
        {
          "category": "mitigation",
          "details": "Common Industrial Protocol (CIP) Security mitigates this vulnerability as it provides the ability to deploy TLS- and DTLS-based secure communications to supported products. CIP Security is an enhancement to the ODVA (Open DeviceNet Vendors Association) EtherNet/IP industrial communication standard and directly addresses this vulnerability. CIP Security allows users to leverage and manage certificates and/or pre-shared keys, and does not make use of any hardcoded keys.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Users requiring setup or deployment guidance for CIP Security protocol should refer to the CIP Security deployment reference guide.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://literature.rockwellautomation.com/idc/groups/literature/documents/at/secure-at001_-en-p.pdf"
        },
        {
          "category": "mitigation",
          "details": "Additionally, Rockwell recommends users follow the following risk mitigation and recommended user actions",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "ControlLogix 5580 v32 or later: Put controller\u0027s mode switch to \u201cRun\u201d mode. If the above cannot be deployed the followings mitigations are recommended: Deploy CIP Security for Logix Designer connections through the front port. CIP Security prevents unauthorized connection when deployed properly. If not using the front port use a 1756-EN4TR ControlLogix Ethernet/IP Module and deploy CIP Security. The 1756-EN4TR supports CIP Security which prevents unauthorized connections when properly deployed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Deploy CIP Security for Logix Designer connections through the front port. CIP Security prevents unauthorized connection when deployed properly.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "If not using the front port, use a 1756-EN4TR ControlLogix Ethernet/IP Module and deploy CIP Security. The 1756-EN4TR supports CIP Security which prevents unauthorized connections when properly deployed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "ControlLogix 5580 v31: Put controller\u0027s mode switch to \u201cRun\u201d mode. If the above cannot be deployed the following mitigations are recommended: Apply v32 or later and follow mitigations actions outlined above. If unable to apply a newer version, use a 1756-EN4TR ControlLogix EtherNet/IP Module and deploy CIP Security. The 1756-EN4TR supports CIP Security, which prevents unauthorized connections when properly deployed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "ControlLogix 5570 v31 or later: Put controller\u0027s mode switch to \u201cRun\u201d mode. If the above cannot be deployed the following mitigations are recommended: Use a 1756-EN4TR ControlLogix EtherNet/IP Module and deploy CIP Security. The 1756-EN4TR supports CIP Security, which prevents unauthorized connections when properly deployed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Use a 1756-EN4TR ControlLogix EtherNet/IP Module and deploy CIP Security. The 1756-EN4TR supports CIP Security, which prevents unauthorized connections when properly deployed.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "ControlLogix 5580 v28-v30, ControlLogix 5570 v18 or later, ControlLogix 5560 v16 or later, ControlLogix 5550 v16, GuardLogix 5580 v31 or later, GuardLogix 5570 v20 or later, GuardLogix 5560 v16 or later, 1768 CompactLogix v16 or later, 1769 CompactLogix v16 or later, CompactLogix 5370 v20 or later, CompactLogix 5380 v28 or later, CompactLogix 5480 v32 or later, Compact GuardLogix 5370 v28 or later, Compact GuardLogix 5380 v31 or later, FlexLogix 1794-L34 v16, DriveLogix 5370 v16 or later. Put controller\u0027s mode switch to \u201cRun\u201d mode.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "SoftLogix 5800: No additional mitigation available. Follow the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://literature.rockwellautomation.com/idc/groups/literature/documents/td/enet-td001_-en-p.pdf"
        },
        {
          "category": "mitigation",
          "details": "Monitor controller change log for any unexpected modifications or anomalous activity.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "If using v17 or later, utilize the Controller Log feature.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "If using v20 or later, utilize Change Detection in the Logix Designer Application.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "If available, use the functionality in Factory Talk AssetCentre to detect changes.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        },
        {
          "category": "mitigation",
          "details": "Rockwell Automation has published a security advisory that further describes how this vulnerability affects the Studio 5000 Logix Designer software and associated controllers.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130301"
        },
        {
          "category": "mitigation",
          "details": "Requests for additional information can be sent to the Rockwell RASecure Inbox (rasecure@ra.rockwell.com).",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ],
          "url": "mailto:rasecure@ra.rockwell.com"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ]
    }
  ]
}