Microsoft Uncovers Major Flaws in Rockwell PanelView Plus
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-2071 | Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve r Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. The device has the functionality, through a CIP class, to execute exported functions from libraries. There is a routine that restricts it to execute specific functions from two dynamic link library files. By using a CIP class, an attacker can upload a self-made library to the device which allows the attacker to bypass the security check and execute any code written in the function. NVD description · AI analysis pending | 9.8 | 11% |
| — | ||
| CVE-2023-29464 | FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. Sending a size larger than the buffer size results in leakage of data from memory resulting in an information disclosure. If the size is large enough, it causes communications over the common industrial protocol to become unresponsive to any type of packet, resulting in a denial-of-service to FactoryTalk Linx over the common industrial protocol. NVD description · AI analysis pending | 9.1 | 10% |
| — |
Full article371 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft’s cybersecurity team has uncovered two significant vulnerabilities in Rockwell Automation’s PanelView Plus, a type of human-machine interface (HMI) widely used in industrial settings.
These vulnerabilities, identified as CVE-2023-2071 and CVE-2023-29464, can be exploited remotely by unauthenticated attackers to perform remote code execution (RCE) and denial-of-service (DoS) respectively.
The RCE vulnerability arises from two custom classes within the PanelView Plus that can be manipulated to upload and load a malicious DLL, allowing attackers to execute arbitrary code on the device. Meanwhile, the DoS vulnerability exploits the same custom class, sending a crafted buffer that the device cannot handle, causing it to crash.
In an advisory published on Tuesday, Microsoft said such vulnerabilities pose a significant risk to organizations relying on these devices for operational processes, as they could lead to unauthorized remote control and disruption of critical operations.
According to the technical write-up, the discovery process began when Microsoft’s Defender for IoT research team observed communication between two devices using the Common Industrial Protocol (CIP).
Further investigation revealed a remote registry query functionality within the HMI, specifically the PanelView Plus. This led the team to hypothesize about potential vulnerabilities that could be exploited to access sensitive system keys or gain control over the device.
By analyzing the firmware of the PanelView Plus, which operates on Windows 10 IoT, researchers identified several DLLs responsible for processing different CIP class IDs. They found that one such DLL could be exploited to upload and execute malicious DLL files, confirming their hypothesis about potential remote-control vulnerabilities.
In May and July 2023, Microsoft reportedly disclosed these findings to Rockwell Automation through its Coordinated Vulnerability Disclosure (CVD) program. In response, Rockwell released security patches and advisories in September and October 2023.
Microsoft has urged all users of PanelView Plus to apply these patches promptly to mitigate potential risks.
Further recommendations from Microsoft include ensuring that all critical devices like PLCs, routers and PCs are disconnected from the internet and segmented, regardless of their use of Rockwell’s FactoryTalk View. Furthermore, they recommend restricting access to CIP devices exclusively to authorized components to bolster overall security protocols.
Image credit: Michael Vi / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-uncovers-flaws-rockwell/