Dragos Enabled Defense Against APT Exploits for Rockwell Automation Control Logix
Summary: Rockwell Automation, in coordination with the U.S. government, analyzed a novel exploit capability attributed to APT actors affecting ControlLogix EtherNet/IP communication modules 1756-EN2 and 1756-EN3 (CVE-2023-3595) and 1756-EN4 (CVE-2023-3596), allowing remote code execution with persistence and denial of service. Dragos used Neighborhood Keeper and OT Watch to assess the prevalence of vulnerable devices and released detections to Platform customers, with Knowledge Pack KP-2023-004 now available.
What's compelling: The access provided by CVE-2023-3595 is similar to the zero-day used by XENOTIME in the TRISIS attack, and exploitation renders the communication module untrustworthy, requiring it to be decommissioned and sent back to the vendor for analysis. As of mid-July 2023 there was no evidence of exploitation in the wild, but the targeted victims and industry verticals were unknown.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2023-3595CVE-2023-3596
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026