5 minhigh
Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix (CVE-2021-42260)
A denial of service vulnerability (CVE-2021-42260) affects multiple Rockwell Automation industrial controllers. The flaw allows remote attackers to trigger an infinite loop via crafted data, causing a major nonrecoverable fault (MNRF) that requires a program download or stage 2 reset to recover. The CVSS v3.1 base score is 7.5 (High).
Sens:▲ 24hConf:high
Showing defanged values
- cveCVE-2021-42260A denial of service vulnerability triggered by crafted data causing an infinite loop, resulting in a major nonrecoverable fault.
Detection / Hunteropenrouter
What Happened
A security flaw has been found in several models of Rockwell Automation industrial controllers used in manufacturing and other critical sectors worldwide. The flaw allows an attacker to send specially crafted data that causes the controller to enter an infinite loop, resulting in a crash that requires manual intervention to fix. Organizations using these controllers should update their firmware to the latest versions provided by Rockwell Automation. If updating is not immediately possible, they should ensure these devices are isolated from the internet and business networks.
Key Takeaways
- A denial of service vulnerability exists in multiple Rockwell Automation industrial controllers triggered by crafted data causing an infinite loop.
- Exploitation results in a major nonrecoverable fault (MNRF) requiring a program download or stage 2 reset to recover.
- Affected products include ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, and Compact GuardLogix controllers with specific firmware versions below 34.015, 35.014, 36.013, and 37.011.
- Rockwell Automation recommends updating to firmware version 34.015, 35.014, 36.013, or 37.011 and later depending on the controller model.
Affected Systems
- Rockwell Automation ControlLogix 5580 (firmware <34.015, <35.014, <36.013, <37.011)
- Rockwell Automation GuardLogix 5580 (firmware <34.015, <35.014, <36.013, <37.011)
- Rockwell Automation CompactLogix 5380 (firmware <34.015, <35.014, <36.013, <37.011)
- Rockwell Automation Compact GuardLogix 5380 (firmware <34.015, <35.014, <36.013, <37.011)
- Rockwell Automation CompactLogix 5480 (firmware <34.015, <35.014, <36.013, <37.011)
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2021-42260 | Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix | High | A denial of service vulnerability triggered by crafted data causing an infinite loop, resulting in a major nonrecoverable fault. |
Attack Chain
- Initial Access: Attacker sends crafted data to a network-accessible Rockwell Automation controller.
- Execution: The controller processes the malformed data, triggering an infinite loop condition.
- Impact: The controller enters a major nonrecoverable fault (MNRF), causing a denial of service.
- Recovery: Manual intervention is required, involving a program download for safety controllers or a stage 2 reset for non-safety controllers.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the advisory.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | None | The affected devices are industrial control systems (PLCs) that do not run standard EDR agents. |
| Network Visibility | Medium | Network monitoring could detect the crafted packets sent to the controller, but specific payload details are not provided in the advisory. |
| Detection Difficulty | Hard | Detecting the specific crafted data that triggers the infinite loop requires knowledge of the malformed payload, which is not detailed in the advisory. |
Required Log Sources
- Network traffic logs to PLCs
- Rockwell Automation diagnostic logs
- Firewall logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for network traffic patterns sending anomalous or malformed data to Rockwell Automation controllers on ports used by the affected products. | Network flow data, IDS alerts, firewall logs | Initial Access | Medium |
| Monitor for unexpected controller faults or resets in Rockwell Automation diagnostic logs that may indicate exploitation attempts. | Rockwell Automation diagnostic logs, syslog from PLCs | Impact | High |
Control Gaps
- Standard endpoint detection tools will not provide visibility into PLC exploitation.
- Network-based detection is limited without specific indicators of the malformed payload.
Key Behavioral Indicators
- Unexpected major nonrecoverable fault (MNRF) events on affected controllers
- Anomalous inbound network connections to PLCs from non-engineering workstations
False Positive Assessment
Medium
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider updating affected Rockwell Automation controllers to firmware versions 34.015, 35.014, 36.013, or 37.011 and later as soon as possible.
- If firmware updates cannot be applied immediately, evaluate whether compensating controls such as network segmentation can be enhanced to restrict access to affected controllers.
- Consider monitoring network traffic to affected controllers for anomalous or unexpected connections.
Infrastructure Hardening
- Evaluate whether control system networks are properly isolated from business networks and the internet.
- If remote access to controllers is required, consider using secure methods such as VPNs and ensure they are updated to the latest version.
- Consider implementing firewalls to restrict access to control system devices to only authorized engineering workstations.
User Protection
- Consider restricting physical and logical access to affected controllers to only authorized personnel.
- If applicable, evaluate whether network access control can be used to limit which devices can communicate with the PLCs.
Security Awareness
- Consider incorporating ICS-specific security awareness training into existing programs for engineers and operators.
- If applicable, remind staff to report any unexpected controller behavior or faults to the appropriate security or operations team.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping2 techniques
Tactic
Execution
Tactic
Impact
Related
Stay currentSubscribe via RSS
