{"id":33876,"date":"2022-05-25T10:17:00","date_gmt":"2022-05-25T07:17:00","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=33876"},"modified":"2026-03-28T00:57:18","modified_gmt":"2026-03-27T21:57:18","slug":"vulnerabilities-in-isagraf-platform-may-affect-different-industries-for-years-to-come","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/vulnerabilities-in-isagraf-platform-may-affect-different-industries-for-years-to-come\/","title":{"rendered":"Vulnerabilities in ISaGRAF platform may affect different industries for years to come"},"content":{"rendered":"\n

In 2020, Kaspersky ICS CERT discovered nine vulnerabilities in the ISaGRAF Runtime platform, which is <\/strong>used as an automation framework in multiple products in various industries across the globe. Besides the <\/strong>industrial control system (ICS),<\/strong> ISaGRAF\u2019s application areas include transportation, power & energy, and other sectors, which means the security of the platform becomes of national interest. The vulnerabilities were fixed by the vendor, Rockwell Automation, in early 2022. The recent report issued by Kaspersky provides an overview of ISaGRAF framework and covers the most critical vulnerabilities identified along with possible attack vectors.<\/strong><\/p>\n\n\n\n

ISaGRAF is a programming technology and execution environment used by industrial entities worldwide. It is owned by Rockwell Automation and, today is customized and extended for different controller devices that belong to various vendors.<\/p>\n\n\n\n

Since the ISaGRAF framework requires adaptation from the end product vendor, it can be difficult to protect users. To find out that a product is vulnerable, the user needs to wait for Rockwell Automation to fix the vulnerabilities and release an advisory and then wait for the product\u2019s vendor to do the same. In some cases, the ISaGRAF supply chain is even longer with third-party vendors. Complicated patching procedures make the remediation process even more difficult as security patches can only be installed during a specific period of time (scheduled maintenance window). <\/p>\n\n\n\n

Kaspersky ICS CERT analyzed the ISaGRAF framework functionality and discovered nine vulnerabilities that can be exploited by a remote or local attacker \u2013 whose ultimate goal is to escape the restricted environment of ISaGRAF and take full control of the device. The research showed that a remote attacker could penetrate the system via the ISaGRAF eXchange Layer (IXL) protocol used to transfer data within the framework. Rockwell Automation has issued a\u00a0security advisory<\/a>, published an update to fix some of the vulnerabilities, and has suggested mitigation measures for others.<\/p>\n\n\n\n

 \u201cThe ISaGRAF Runtime environment is considered to be the essential programming tool used within different industries throughout the world, including those of national importance. At Kaspersky, we have discovered several vulnerabilities that might greatly affect this system and its functionality. Although some of the vendors issued security patches to fix the discovered issues, our report underscores how serious these vulnerabilities in third-party components can be. Once again, we\u2019d like to draw the attention of the product\u2019s vendors to the advisory and the need to act on it,\u201d<\/em> comments Evgeny Goncharov, Head of Kaspersky ICS CERT. <\/p>\n\n\n\n

Learn more about the ISaGRAF framework and the uncovered vulnerabilities\u00a0on Kaspersky\u2019s ICS CERT website<\/a>.<\/p>\n\n\n\n

To keep your ICS computers protected from various threats, Kaspersky experts recommend: <\/strong><\/p>\n\n\n\n