CVE-2022-1161: CompactLogix Privilege Escalation Flaw

CVE-2022-1161 Overview

CVE-2022-1161 is a critical code injection vulnerability affecting Rockwell Automation's industrial control systems, including ControlLogix, CompactLogix, and GuardLogix programmable logic controllers (PLCs). This vulnerability allows an attacker with the ability to modify a user program to change the executed code on affected control systems while leaving the human-readable source code untouched. Studio 5000 Logix Designer writes user-readable program code to a separate memory location than the executed compiled code, enabling attackers to manipulate the running program without detection through standard code review processes.

Critical Impact

Attackers can covertly modify PLC logic execution while the displayed source code appears unchanged, potentially causing physical damage to industrial processes, safety system bypasses, or production disruptions without triggering standard code integrity checks.

Affected Products

• Rockwell Automation ControlLogix 5550, 5560, 5570, 5580 Series Controllers
• Rockwell Automation CompactLogix 1768, 1769, 5370, 5380, 5480 Series Controllers
• Rockwell Automation GuardLogix 5560, 5570, 5580 and Compact GuardLogix 5370, 5380 Safety Controllers
• Rockwell Automation FlexLogix 1794-L34 Controllers
• Rockwell Automation DriveLogix 5730 Controllers
• Rockwell Automation SoftLogix 5800 Emulation Software

Discovery Timeline

• April 11, 2022 - CVE-2022-1161 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-1161

Vulnerability Analysis

This vulnerability exploits a fundamental architectural design flaw in how Rockwell Automation's Logix controllers handle program storage and execution. The Studio 5000 Logix Designer development environment stores two separate representations of user programs: the human-readable source code (ladder logic, structured text, or function block diagrams) and the compiled binary bytecode that the PLC actually executes.

The critical security gap occurs because these two code representations are stored in different memory locations and can be modified independently. An attacker who gains access to the PLC's memory can alter the compiled executable code while leaving the source code representation completely unchanged. This means that when an engineer connects to the controller and views the program through Studio 5000, they see the original, legitimate code—while the actual running program has been maliciously modified.

This attack technique is particularly dangerous in industrial control system (ICS) environments because it undermines the fundamental assumption that code review and comparison tools can detect unauthorized changes. Traditional integrity verification methods that compare uploaded code against the controller's stored program would fail to detect this manipulation.

Root Cause

The root cause of CVE-2022-1161 is an inclusion of functionality from an untrusted control sphere (CWE-829). The Logix controller platform trusts and executes compiled bytecode without adequately verifying its correspondence to the stored source code representation. The architecture lacks cryptographic binding or integrity verification between the human-readable program and its compiled counterpart, allowing independent modification of either component.

Attack Vector

The attack can be executed over the network by an adversary who has gained access to the industrial control network where affected Rockwell Automation controllers reside. The attacker requires the ability to communicate with the PLC using Rockwell's proprietary EtherNet/IP protocol and must have sufficient access to modify program memory. Once network access is achieved, the attacker can:

1. Connect to the target PLC using EtherNet/IP protocol
2. Locate the compiled bytecode section in controller memory
3. Modify the executable code to alter process logic, disable safety functions, or introduce malicious behavior
4. Leave the source code section unchanged to evade detection
5. The modified logic executes while the displayed program appears legitimate

This stealthy approach allows the malicious code to persist through normal engineering activities since code uploads and comparisons only verify the unchanged source representation.

Detection Methods for CVE-2022-1161

Indicators of Compromise

• Unexpected process behavior or output values that do not correspond to the visible program logic
• Discrepancies between expected and actual controller memory checksums when using firmware-level verification tools
• Anomalous EtherNet/IP traffic patterns indicating unauthorized program memory access or modification
• Controller fault logs showing unexpected execution paths or instruction sequences

Detection Strategies

• Implement offline code verification by comparing controller memory dumps against known-good baselines at the bytecode level, not just source code level
• Deploy network intrusion detection systems (IDS) with signatures for Rockwell Automation protocol anomalies and unauthorized programming commands
• Enable and monitor controller audit logs for any program modification events or unauthorized access attempts
• Utilize Rockwell Automation's verification tools specifically designed to detect compiled code tampering

Monitoring Recommendations

• Establish continuous monitoring of EtherNet/IP traffic to and from Logix controllers for unauthorized programming sessions
• Implement change management processes that include firmware-level integrity verification after any maintenance activities
• Deploy security information and event management (SIEM) solutions to correlate ICS network events with potential attack indicators
• Regularly perform forensic analysis of controller memory to detect bytecode modifications

How to Mitigate CVE-2022-1161

Immediate Actions Required

• Segment industrial control networks from business networks and implement strict access controls to limit who can communicate with PLCs
• Disable unused communication protocols and services on affected controllers
• Implement application whitelisting on engineering workstations to prevent unauthorized programming tools from connecting to controllers
• Review and restrict user accounts with permissions to modify PLC programs

Patch Information

Rockwell Automation has released security advisories addressing this vulnerability. Organizations should consult the CISA ICS Advisory ICSA-22-090-05 for detailed remediation guidance and firmware updates. Contact Rockwell Automation support for specific firmware versions that address this vulnerability and follow vendor guidance for safe upgrade procedures in production environments.

Workarounds

• Enable the Controller Change Detection feature in Studio 5000 Logix Designer to receive alerts when controller programs are modified
• Implement physical key switch controls on controllers where available to restrict mode changes
• Use CIP Security features on supported controllers to authenticate and encrypt communications
• Establish network segmentation using industrial firewalls and demilitarized zones (DMZ) to control access to PLC networks

# Network segmentation verification example
# Verify that affected Rockwell controllers are not directly accessible from untrusted networks
# Check firewall rules blocking EtherNet/IP (TCP/UDP 44818) from unauthorized sources
iptables -L -n | grep 44818

# Verify only authorized engineering stations can reach PLC network
nmap -sU -sT -p 44818 <controller_ip_range> --reason