What is the vulnerability reported by Rockwell Automation?

Rockwell Automation has reported a vulnerability in the Cisco IOS XE software that was actively exploited prior to October 16th.

Which devices are affected by this vulnerability?

The vulnerability affects specific versions of Stratix products running Cisco IOS software, including Stratix 5800 (with the Web UI feature enabled) and Stratix 5200 (with the Web UI feature enabled) in all versions.

What are the recommended mitigating measures for this vulnerability?

Cisco's advisory suggests disabling the HTTP server on the affected devices, particularly on the public-facing interface, as a mitigating measure.

Is there a patch available for this vulnerability?

Yes, as of October 23rd, Cisco has released a patch for this vulnerability. Customers of Rockwell Automation who are affected by this issue are advised to contact Rockwell Automation for guidance on updating their devices.

Advisory

Rockwell Automation Stratix routers vulnerable to Cisco IOS XE vulnerability

published: Oct. 25, 2023

Take action: Comb through all Rockwell 5200 and 5800 routers disable the WebUI/HTTP server on the internet facing interfaces and check for unknown user accounts. Then work with Rockwell to apply the patch ASAP.

Learn More

Rockwell Automation, is reporting vulnerable devices to the Cisco IOS XE software vulnerability. The vulnerability is already actively exploited since before 16th of October.

The vulnerability affects certain versions of Stratix products running Cisco IOS software:

Stratix 5800 (with the Web UI feature enabled) - All versions
Stratix 5200 (with the Web UI feature enabled) - All versions

The mitigating measures of the Cisco advisory are the same - disable the HTTP server on the devices, especially on the public facing interface.

As of 23rd of October Cisco has published a patch, so customers of Rockwell Automation should reach out to Rockwell for advice on updating.

Rockwell Automation Stratix routers vulnerable to Cisco IOS XE vulnerability

Read More
QNAP releases patches for two vulnerabilities, severity unclear. …
Critical authentication vulnerability reported in Yokogawa Recorder Products
Siemens Issues Fix for Maximum Severit flaw in …
Critical authentication bypass flaw reported in Instantel Micromate …
Multiple Vulnerabilities Reported in Johnson Controls Frick Quantum …