Critical Vulnerability Detected in Rockwell Automation's Verve Asset Manager

In a sobering update for cybersecurity professionals and organizations relying on Rockwell Automation’s technologies, a significant vulnerability has been identified in the Verve Asset Manager. This advisory, published by the Cybersecurity and Infrastructure Security Agency (CISA), highlights critical security risks that could lead to dire consequences if not addressed promptly.

1. Executive Summary​

The vulnerability has been assigned a CVSS v4 score of 8.6, indicating it is both severe and exploitable with relatively low attack complexity. The vulnerability stems from a dependency on a vulnerable third-party component, notably Kibana, which is part of the Verve Asset Manager system. Rockwell Automation has identified that the following versions are affected:

• Verve Asset Manager: Versions 1.39 and prior

In essence, a successful exploit of this vulnerability could lead to arbitrary code execution, allowing attackers to execute malicious commands within the application’s container, therefore posing a serious risk to data integrity and operational efficiency.

2. Risk Evaluation​

The exploitation of this vulnerability can enable attackers to gain unauthorized access and execute commands that could compromise the entire system. The implications here extend beyond mere data breaches; they could potentially disrupt operational processes in critical manufacturing infrastructures, making timely remediation crucial.

3. Technical Details​

3.1 Affected Products​

Only specific versions of the Verve Asset Manager are at risk, particularly:

• Versions up to 1.39

3.2 Vulnerability Overview​

The identified vulnerability is categorized under CWE-1395, which denotes a dependency on a vulnerable third-party component—in this case, Kibana. This situation arises because the attack vector allows individuals with access to machine learning (ML) features to exploit a prototype pollution vulnerability. This can lead to arbitrary code execution limited to the context of the affected container.

3.3 Background​

• Critical Infrastructure Sector: Critical Manufacturing
• Countries/Areas Deployed: Worldwide
• Company Headquarters: United States

This vulnerability is integral to understanding the cybersecurity posture of organizations using Rockwell Automation’s critical systems.

3.4 Research & Reporting​

This vulnerability was publicly disclosed by Rockwell Automation through a report submitted to CISA, drawing attention to the urgency of implementing adequate security measures.

4. Mitigations​

To counteract the profile of this vulnerability, Rockwell Automation recommends the following mitigative actions:

• Restrict Access to Built-in Verve Account
• Limit access to only those administrators who need to perform necessary functions.
• Change the default password to mitigate unauthorized access risks.
• Restrict Privileges for Other Accounts
• Use built-in roles to delegate permissions carefully, ensuring that users have access only to what is essential while preventing them from executing the vulnerability.
• Disable Machine Learning Features
• Edit the Elasticsearch configuration to deactivate machine learning features, effectively removing the attack vector.
• Users must follow detailed steps to do this safely, including utilizing Docker commands to modify container configurations.
• CISA Recommendations
• Minimize network exposure of control systems.
• Use firewalls to isolate control systems from business networks.
• Implement Virtual Private Networks (VPNs) for secure remote access, albeit with the knowledge that VPNs themselves can be vulnerable if not updated regularly.

5. Conclusion and Recommendations​

The discovery of this vulnerability underscores the critical need for proactive risk management in industrial control systems. Organizations must conduct thorough risk assessments, implement the recommended mitigations, and remain vigilant against potential exploitation activities.
While no public reports indicate active attempts to exploit this vulnerability, staying informed and updated remains paramount. Furthermore, addressing social engineering risks—such as avoiding links in unsolicited emails and recognizing phishing attacks—should also form part of the broader security strategy.
For further information, CISA continuously updates its advisories and provides outreach on best practices for securing industrial control systems. Organizations should stay engaged with these resources as they work to fortify their cybersecurity defenses.
In the world of cybersecurity, especially within critical manufacturing, attention to detail and proactive measures can be the difference between safety and significant operational disaster. Let's not wait until the alarm bells are ringing; take action now!

---

Source: CISA Rockwell Automation Verve Reporting (Update A) | CISA