OTPulse
FeedAboutContact

Rockwell Automation Kinetix 5500

Act Now9.4ICS-CERT ICSA-23-131-09May 11, 2023
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Rockwell Automation Kinetix 5500 devices manufactured between May 2022 and January 2023 (firmware version 7.13) contain an improper access control vulnerability that allows attackers without credentials to cause a denial-of-service condition or gain unauthorized access to the drive. The flaw is in the device's network request handling, which lacks proper validation and authorization checks. Exploitation requires only network access to the device and the ability to send crafted requests.

What this means
What could happen
An attacker with network access to a Kinetix 5500 drive could cause the device to stop responding (denial of service) or gain unauthorized control, potentially halting motion control operations in production equipment or conveyor systems.
Who's at risk
Water utilities and municipal electric providers using Kinetix 5500 variable frequency drives (VFDs) or servo drives for pump motors, fan drives, conveyor systems, or other motion control applications should assess their risk. Devices manufactured between May 2022 and January 2023 are affected.
How it could be exploited
An attacker on the network segment containing the Kinetix 5500 could send a specially crafted request to the device's exposed network interface. The device lacks proper input validation or authorization checks, allowing the attacker to trigger a crash or execute commands without authentication.
Prerequisites
  • Network access to the Kinetix 5500 device (typically Ethernet port 502 or standard EtherCAT/Ethernet/IP ports)
  • No credentials required
  • Device must be on a network path reachable from the attacker
Remotely exploitableNo authentication requiredLow complexity attackHigh impact (denial of service and unauthorized access)Affects motion control in operational equipmentAffected production run is limited (May 2022–January 2023) but critical if you have those units
Exploitability
Low exploit probability (EPSS 0.3%)
Affected products (1)
ProductAffected VersionsFix Status
Kinetix 5500 devices manufactured between May 2022 and January 2023:7.13No fix yet
Remediation & Mitigation
0/4
Do now
0/3
HARDENINGIsolate Kinetix 5500 devices on a separate control system network behind a firewall, not accessible from the business network or Internet
WORKAROUNDRestrict network access to Kinetix 5500 devices using firewall rules; only allow connections from authorized engineering and control workstations
HARDENINGIf remote access to Kinetix 5500 is required, route it through a VPN with current security updates; do not expose the device directly to remote access
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpgrade Kinetix 5500 firmware to version 7.14 or later
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/bd836477-2f69-4a39-8b55-fc0182d793c2