CVE-2024-9124
📋 TL;DR
A denial-of-service vulnerability in Rockwell Automation PowerFlex 600T drives allows attackers to make the device unavailable by overloading it with requests. The device may require a physical power cycle to recover if it doesn't automatically reconnect after the attack stops. This affects industrial control systems using these specific drives.
💻 Affected Systems
- Rockwell Automation PowerFlex 600T
📦 What is this software?
Powerflex 6000t Firmware by Rockwellautomation
Powerflex 6000t Firmware by Rockwellautomation
Powerflex 6000t Firmware by Rockwellautomation
⚠️ Risk & Real-World Impact
Worst Case
Critical industrial processes halt completely, requiring physical intervention and power cycling of affected drives, potentially causing production downtime, safety issues, or equipment damage.
Likely Case
Temporary disruption of motor control functions until attack stops or device is manually reset, causing production delays.
If Mitigated
Minimal impact with proper network segmentation and rate limiting preventing attack traffic from reaching devices.
🎯 Exploit Status
Simple DoS attack requiring only ability to send network requests to the device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Refer to Rockwell Automation advisory for specific firmware versions
Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1705.html
Restart Required: Yes
Instructions:
1. Download updated firmware from Rockwell Automation website. 2. Follow firmware update procedures for PowerFlex 600T drives. 3. Verify firmware version after update. 4. Test drive functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate PowerFlex drives on separate network segments with strict firewall rules
Rate Limiting
allImplement network rate limiting to prevent request flooding
🧯 If You Can't Patch
- Implement strict network segmentation to isolate drives from untrusted networks
- Deploy industrial firewall with rate limiting and connection monitoring
🔍 How to Verify
Check if Vulnerable:
Check firmware version against Rockwell advisory and verify if device responds to excessive network requestsCheck Version:
Use Rockwell Automation software tools or device interface to check firmware versionVerify Fix Applied:
Verify firmware version matches patched version in advisory and test with controlled request flooding📡 Detection & Monitoring
Log Indicators:
- Unusual high volume of network requests to drive IPs
- Drive communication failures
- Drive status showing as unresponsive
Network Indicators:
- Spike in traffic to drive ports
- Repeated connection attempts to drive IPs
- Abnormal request patterns
SIEM Query:
source_ip=* dest_ip=[drive_ips] | stats count by source_ip | where count > threshold