Rockwell Automation ISaGRAF

Risk Summary

Successful exploitation of this vulnerability could allow arbitrary code execution.

CVEs (1)

Remediations

• Rockwell Automation encourages users to update to v20.00 or later.
• For the ISaGRAF Workbench and Safety Instrumented Systems Workstation, Rockwell Automation encourages users to use mitigations listed below until a patch is released. More mitigation actions are planned.
• If an upgrade is not possible or available, users should apply the following mitigations:
• Run Connected Components Workbench as a User, not as an Administrator, to minimize the impact of malicious code on the infected system.
• Do not open untrusted files with Connected Component Workbench, ISaGRAF, SISW. Employ training and awareness programs to educate users on the warning signs of a phishing or social engineering attack.
• Use Microsoft AppLocker or other similar allow list application to help mitigate risk. Information on using AppLocker with Rockwell Automation products is available at KnowledgeBase Article QA17329
• Ensure the least-privilege user principle is followed, and user/service account access to shared resources (such as a database) is only granted with a minimum number of rights as needed.
• For more information see Rockwell Automation's security advisory.

Affected Vendors

Affected Products (3)

Affected Sectors

Multiple Sectors