Rockwell Automation PanelView 800
Act Now9.8ICS-CERT ICSA-23-271-01Sep 28, 2023
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
A vulnerability exists in PanelView 800 operator interface panels (models 2711R-T10T, 2711R-T7T, 2711R-T4T) running version 3.011 related to improper input validation. An attacker on the network can exploit this to disclose sensitive information, modify configuration or process data, or cause a denial-of-service condition that renders the operator interface unavailable. No authentication is required for exploitation.
What this means
What could happen
An attacker with network access to a PanelView 800 could read sensitive information from the device, alter settings or data, or crash the interface, interrupting operator visibility and control of industrial processes.
Who's at risk
Water utilities, electric utilities, and manufacturers using PanelView 800 operator interface panels (models 2711R-T10T, 2711R-T7T, 2711R-T4T) for process monitoring and control in version 3.011 should be concerned. These panels are the primary human-machine interface (HMI) for many industrial processes.
How it could be exploited
An attacker on the network sends a specially crafted input or request to the PanelView 800 without needing credentials or user interaction. The vulnerability in input validation allows the attacker to execute commands or access memory on the device, potentially reading configuration data, modifying process parameters, or causing the interface to fail.
Prerequisites
- Network access to the PanelView 800 device
- Device must be reachable from attacker's network segment (not behind a firewall or air-gapped)
- No authentication required
Remotely exploitableNo authentication requiredLow complexity attackCritical CVSS score (9.8)Affects HMI/operator interfacePatch requires firmware update during maintenance window
Exploitability
Low exploit probability (EPSS 0.6%)
Affected products (3)
3 with fix
ProductAffected VersionsFix Status
PanelView 800 2711R-T10T: V3.011V3.011v6.011 or later
PanelView 800 2711R-T7T: V3.011V3.011v6.011 or later
PanelView 800 2711R-T4T: V3.011V3.011v6.011 or later
Remediation & Mitigation
0/4
Do now
0/3HARDENINGIsolate PanelView 800 devices on a separate network segment behind firewall rules that block inbound access from business networks and the internet
WORKAROUNDIf remote access is required, implement VPN access with current patches and strict access controls
HARDENINGRestrict network access to PanelView 800 to only authorized engineering and operations personnel IP addresses
Schedule — requires maintenance window
0/1Patching may require device reboot — plan for process interruption
HOTFIXUpdate PanelView 800 firmware to version 6.011 or later
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/19c5b586-4776-475e-840b-fab88e83ca9b