Implications of Log4j Vulnerability for Operational Technology (OT) Networks
Summary: Security researchers disclosed a zero-day remote code execution vulnerability tracked as CVE-2021-44228 in the Log4j2 Java logging library, and Dragos Intelligence assessed with high confidence that it will impact OT networks given the library's ubiquity. Dragos observed both attempted and successful exploitation in the wild, coordinated a takedown of one malicious domain used in early attempts, and noted attacks using LDAP, DNS, and RMI, with OT elements such as SCADA/EMS configured for remote access potentially vulnerable to lateral movement.
What you should know: Dragos expects Log4j to persist inside ICS environments for years, and OT operators running Java-based products no longer supported by their vendors may find remediation is not possible at all - leaving mitigation steps that must first be tested in a lab against the risk of operational impact.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2021-44228
- Related
- CVE-2021-44228: Apache Log4j2 Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Dec 10, 2021