Description

CVE-2024-6242 is a vulnerability in Rockwell Automation products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. This could potentially allow an attacker to execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis. The SVRS for this vulnerability is 30, indicating a moderate level of risk.

Key Insights

• This vulnerability could allow an attacker to gain control of a Logix controller, which could lead to a loss of control over the affected system.
• The vulnerability is exploitable remotely, which means that an attacker does not need to have physical access to the affected system.
• There are no known active exploits for this vulnerability, but it is possible that exploits could be developed in the future.

Mitigation Strategies

• Update to the latest version of the affected software.
• Disable the Trusted® Slot feature on affected devices.
• Implement network segmentation to isolate critical systems from the internet.
• Use a firewall to block unauthorized access to the affected systems.

Additional Information

• The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
• There are no known threat actors or APT groups that are actively exploiting this vulnerability.
• This vulnerability is not currently being used in the wild.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.