Rockwell Automation Urges Customers to Disconnect ICS from the Internet

Rockwell Automation has released a security notice urging customers to ensure that their industrial control systems (ICS) are not connected to the internet and exposed to cyber threats.

The industrial automation giant has advised customers to take immediate action and check whether any devices not specifically designed for public connection are exposed on the network.

Currently, searching for "Rockwell" on Shodan returns over 7,000 results, including thousands of items that appear to be Allen-Bradley Programmable Logic Controllers (PLCs).

The company is concerned that attacks could occur "due to heightened geopolitical tensions and global adversarial cyber activity."

Rockwell stated: "In accordance with Rockwell Automation's guidance for all devices not specifically designed for public internet connectivity (such as cloud and edge products), users should never configure their assets to connect directly to the public-facing internet. Proactively removing this connectivity reduces the attack surface and can immediately mitigate the risk of unauthorized and malicious cyber activity by external attackers."

Rockwell's advisory highlights several vulnerabilities discovered and patched in recent years, including CVE-2021-22681, CVE-2022-1159, CVE-2023-3595 and CVE-2023-3596, CVE-2023-46290, CVE-2024-21914, CVE-2024-21915, and CVE-2024-21917.

These vulnerabilities could allow hackers to launch DoS attacks, escalate privileges, modify settings, remotely attack PLCs, or even launch Stuxnet-style attacks.

The discovery of exploits targeting CVE-2023-3595 and CVE-2023-3596 indicates that attackers, particularly APT groups, have set their sights on Rockwell industrial products and have at least attempted to exploit Rockwell product vulnerabilities. However, there are currently no confirmed reports of actual attacks.

According to the ATT&CK ICS framework mapping, the Security Incident Response and Threat Intelligence Platform now includes attack techniques related to industrial control environments. We provide industrial enterprises with real-world attack simulations based on complete cyber kill chains, helping them detect, identify, assess, and mitigate the destructive impacts of cyber attacks targeting industrial control environments, thereby effectively safeguarding industrial control security.