CVE-2021-32926
📋 TL;DR
This vulnerability allows an authenticated attacker to intercept password change requests and replace the legitimate password hash with their own, locking legitimate users out of affected Rockwell Automation controllers. It affects Micro800 controllers (all versions) and MicroLogix 1400 controllers (version 21 and later).
💻 Affected Systems
- Rockwell Automation Micro800
- Rockwell Automation MicroLogix 1400
📦 What is this software?
Micro800 Firmware by Rockwellautomation
Micrologix 1400 Firmware by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Critical industrial control systems become inaccessible to legitimate operators, potentially disrupting manufacturing processes or safety systems.
Likely Case
Targeted denial-of-service attacks against specific users or administrators, causing operational disruptions.
If Mitigated
Minimal impact with proper network segmentation and authentication controls limiting attacker access.
🎯 Exploit Status
Exploitation requires intercepting network traffic during password change operations and modifying the hash.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Rockwell Automation security advisory for specific firmware updates
Vendor Advisory: https://us-cert.cisa.gov/ics/advisories/icsa-21-145-02
Restart Required: Yes
Instructions:
1. Review Rockwell Automation security advisory. 2. Download appropriate firmware updates. 3. Apply updates following vendor procedures. 4. Restart controllers as required.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected controllers in separate network segments with strict access controls.
Encrypted Communications
allUse encrypted protocols (like CIP Security) for all controller communications.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can communicate with controllers
- Monitor for unusual password change activity and implement multi-factor authentication where possible
🔍 How to Verify
Check if Vulnerable:
Check controller firmware version against affected versions list in advisory.Check Version:
Use Rockwell Automation programming software (like Connected Components Workbench) to read controller firmware version.Verify Fix Applied:
Confirm firmware version has been updated to non-vulnerable version.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by password change requests
- Unusual source IP addresses accessing controller authentication functions
Network Indicators:
- Unencrypted password change traffic on network
- Man-in-the-middle activity between controllers and management stations
SIEM Query:
source_ip IN (controller_ips) AND (event_type="authentication" OR event_type="password_change") AND result="failure"