Welcome to the new Rockwell Automation Security Advisory portal. Click here to read more about our security advisory initiative. In the past, our security advisories were stored in the Rockwell Automation Knowledgebase and required authentication to obtain access. This new portal gives customers and partners easier access to advisories, which enables them to better manage the security posture of Rockwell Automation solutions. Our new Security Advisory Portal includes search and filter functionality, enabling customers to more easily find advisories on their products.
Security advisories now include Common Security Advisory Framework 2. We strongly encourage customers to use this information to prioritize remediation efforts within their vulnerability management processes. These changes support our commitment to security and transparency. The legacy Industrial Security Advisory Index page in the Knowledgebase will remain accessible through mid to allow customers time to transition to the new portal.
Customers will continue to receive email alerts based on their subscription preferences and can subscribe for alerts using the link on the Security Advisory portal. Mitigations and Workarounds Customers using the affected software are encouraged to apply the risk mitigations, if possible.
Control access to the database by non-essential users. For information on how to mitigate Security Risks on industrial automation control systems, we encourage customers to implement our suggested security best practices to minimize the risk of the vulnerability. Customers can use Stakeholder-Specific Vulnerability Categorization to generate more environment-specific prioritization.
CVE was found internally by Rockwell Automation during routine testing. Rockwell Automation used the latest version of the CVSS scoring system to assess the following vulnerabilities. An encryption vulnerability exists in all versions prior to V The vulnerability exists due to a weak encryption methodology and could allow a threat actor to extract passwords belonging to other users of the application.
