Compliance Impact

The vulnerability involves sensitive information disclosure through the exposure of CIP Connection IDs on the diagnostics webpage accessible to unauthenticated users. This exposure could potentially lead to unauthorized access or denial-of-service attacks.

However, there is no specific information provided about how this vulnerability directly impacts compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is a sensitive information disclosure issue found in CompactLogix controllers. The controller's web server exposes CIP Connection IDs on its diagnostics webpage, which can be accessed by any unauthenticated user on the network.

An attacker can use these exposed CIP Connection IDs to craft malicious packets that may lead to a Denial-of-Service (DoS) condition on the affected device.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing an attacker to cause a Denial-of-Service (DoS) on the affected CompactLogix controller. This can disrupt the normal operation of the controller, potentially affecting any systems or processes that rely on it.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves the exposure of CIP Connection IDs on the diagnostics webpage of affected CompactLogix controllers, accessible to any unauthenticated user on the network.

To detect this vulnerability, you can attempt to access the diagnostics webpage of the CompactLogix controller from an unauthenticated network position and check if CIP Connection IDs are visible.

Network scanning tools or HTTP request commands (such as curl or wget) can be used to retrieve the diagnostics webpage content to verify if the sensitive information is exposed.

• Use curl to fetch the diagnostics page: curl http://<controller-ip>/diagnostics
• Use a web browser or automated scripts to check for the presence of CIP Connection IDs in the webpage content.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting network access to the CompactLogix controller's web server to trusted users only, preventing unauthenticated users from accessing the diagnostics webpage.

Applying firmware updates provided by Rockwell Automation that address this vulnerability is recommended once available.

Monitoring network traffic for suspicious activity related to CIP Connection IDs and implementing network segmentation to isolate the controller can also reduce risk.

Useful 0 Not Useful 0