Home / Advisories / KLCERT advisories / KLCERT-20-023: Rockwell Automation ISaGRAF Runtime: Information Disclosure due to Cleartext Transmission of Information over IXL protocol

KLCERT-20-023: Rockwell Automation ISaGRAF Runtime: Information Disclosure due to Cleartext Transmission of Information over IXL protocol

Kaspersky publishes information on newly identified vulnerabilities in order to raise user awareness of the IT security threats detected. Kaspersky does not make any guarantees in respect of information received from vendors of products in which vulnerabilities have been identified, which is included in the following sections of the advisory: Affected Products, Vendor Mitigation.

KLCERT-ID KLCERT-20-023
CVE CVE-2020-25178
CWE CWE-319: Cleartext Transmission of Sensitive Information
Publication date 2021-07-13
Researcher Alexander Nochvay
Description

Data transferred over IXL protocol is unencrypted.

Impact

An attacker could read and modify all data transferred between ISaGRAF Workbench and ISaGRAF Runtime if the communication is carried out over IXL protocol.

Severity
CVSS v3 Base Score 6.8 (Medium)
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Exploitability ⚠ Remotely exploitable: network access to port 1131/TCP is required
Difficulty High skill level to exploit: an attacker must perform Man-in-the-Middle attack
Privilege required ⚠ No privileges required
User interaction User interaction required: a user must communicate over IXL protocol
Confidentiality ⚠ Confidentiality of the system may be seriously affected: An attacker could read all data transferred between ISaGRAF Workbench and ISaGRAF Runtime if the communication is carried out over IXL protocol.
Integrity ⚠ Integrity of the system may be seriously affected: An attacker could modify all data transferred between ISaGRAF Workbench and ISaGRAF Runtime if the communication is carried out over IXL protocol.
Affected products
Affected products
  • AADvance Controller:
    • All firmware versions
  • Based on ISaGRAF Runtime 5 controllers:
    • All software versions
  • Micro800 family:
    • All firmware versions
  • ISaGRAF Free Runtime:
    • All software versions
Mitigation
Rockwell Automation mitigation

Customers should consider using proper network infrastructure controls, such as firewalls, UTM devices, VPN, or other security appliance.

To reduce risk, customers should ensure they are employing proper network segmentation and security controls. Specifically, network exposure for all control system devices should be minimized, and control systems should be behind firewalls and isolated from other networks when possible. Refer to the Converged Plantwide Ethernet (CPwE) Design and Implementation Guide for best practices deploying network segmentation and broader defense-in-depth strategies.

For ISaGRAF, restrict or block traffic on TCP 1131 from outside of the industrial control system network zone. For more information on the TCP/UDP ports used by ISaGRAF refer to product documentation.

Since ISaGRAF 5 Runtime is provided to a customer as a development kit, implementing least-privilege may vary from implementation to implementation based on the hardware in use.

For AADvance controllers, customers are encouraged to restrict or block traffic on TCP 1132 from outside of the industrial control system network zone.

For Micro800 family, to reduce risk, customers are encouraged to protect the controller with a password.1


  1. For more information on the TCP/UDP ports used by Rockwell Automation products, see BF7490.↩︎

Timeline 2020-02-21 – Vulnerability reported
2020-03-11 – Rockwell Automation confirmed the vulnerability
2021-06-08 – Rockwell Automation published the advisory
2021-06-17 – ICS CERT published the advisory