Rockwell Automation Studio 5000 Logix Emulate
Plan Patch7.8ICS-CERT ICSA-22-356-02Dec 22, 2022
Attack VectorLocal
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Studio 5000 Logix Emulate versions 20-33 contain an insufficient access control vulnerability (CWE-284) that allows a local user with a valid account to execute arbitrary code within the software. Successful exploitation could compromise the confidentiality, integrity, and availability of the engineering environment and PLC logic. The vulnerability requires local access and is not remotely exploitable. Rockwell Automation recommends upgrading to version 34.00 or later.
What this means
What could happen
An attacker with local access to a machine running Studio 5000 Logix Emulate could execute arbitrary code, potentially gaining control of the engineering environment and the PLC logic it controls. This could allow modification of control logic, data theft, or disruption of programming workflows.
Who's at risk
Engineering and automation teams at water authorities, electric utilities, and other critical infrastructure operators who use Rockwell Automation Studio 5000 Logix Emulate for PLC programming and testing. This affects the confidentiality and integrity of control logic and process configurations.
How it could be exploited
An attacker with a user account on a machine running Studio 5000 Logix Emulate v20-33 could exploit an insufficient access control issue to execute code within the software. The attack does not require network access—only local login credentials and presence on the machine itself.
Prerequisites
- Local user account on the machine running Studio 5000 Logix Emulate v20-33
- Physical or remote desktop access to the engineering workstation
Insufficient access control in softwareNo patch available yet from vendorAffects engineering environment with access to production control logic
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (1)
ProductAffected VersionsFix Status
Studio 5000 Logix Emulate: Studio 5000 Logix Emulate v .20-3320-3334.00 or later
Remediation & Mitigation
0/4
Do now
0/1HARDENINGRestrict local access to engineering workstations running Studio 5000 Logix Emulate to authorized personnel only
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpgrade Studio 5000 Logix Emulate to version 34.00 or later
Long-term hardening
0/2HARDENINGIsolate engineering workstations and PLC emulation environments from the business network
HARDENINGImplement strong access controls and enforce multi-factor authentication on engineering workstations
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/11c2d5d9-e299-464d-90cc-72d7343e5a45