Rockwell Automation Analytics LogixAI Redis exposure

10 October 2025 routine vulnerability manufacturing

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Overpermissive Redis instance in Analytics LogixAI 3.00/3.01 allows intranet attackers to access and alter sensitive data.

Rockwell Automation Analytics LogixAI versions 3.00 and 3.01 contain an open database vulnerability stemming from an overpermissive Redis instance. An attacker on the adjacent network (intranet) with low attack complexity can access sensitive system information and potentially alter data without authentication. The vulnerability is scored CVSS 8.7 v4 (8.8 v3.1) and is not remotely exploitable; it requires network adjacency to the affected system.

Rockwell Automation has released a product update addressing this issue. CISA reports no known public exploitation of this vulnerability at the time of advisory publication. Organizations unable to upgrade immediately should implement network segmentation, restrict control system access from business networks, and deploy VPNs for remote access. The issue affects critical manufacturing infrastructure deployed worldwide.

Mentioned in this report

Vulnerabilities CVE-2025-9364

Detection guidance

Redis CLI Used Against Remote Host to Enumerate or Dump Data (Windows)

ATT&CK T1530

redis-cli.exe run against a non-local host with enumeration or dump commands, matching unauthenticated access to an exposed Redis instance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Redis CLI Used Against Remote Host to Enumerate or Dump Data (Windows)
description: Detects redis-cli.exe pointed at a remote host (-h) with data-enumeration
  or dump options such as KEYS, INFO, CONFIG GET, SCAN, --bigkeys. Matches an adjacent-network
  attacker reading data from an overpermissive, unauthenticated Redis instance. Localhost
  targets are filtered out.
tags:
- attack.discovery
- attack.collection
- attack.t1526
- attack.t1530
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \redis-cli.exe
  selection_remote:
    CommandLine|contains: ' -h '
  selection_cmd:
    CommandLine|contains:
    - ' keys '
    - ' info'
    - config get
    - ' scan'
    - --scan
    - --bigkeys
    - ' dump '
    - ' hgetall'
  filter_local:
    CommandLine|contains:
    - -h 127.0.0.1
    - -h localhost
    - -h ::1
  condition: selection_img and selection_remote and selection_cmd and not filter_local
falsepositives:
- Database administrators or developers troubleshooting a remote Redis server from
  a workstation
- Monitoring or health-check scripts that call redis-cli INFO against remote nodes
level: medium
id: fdba1677-30f4-57bf-a427-a982433d99fd
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-252-08

Redis CLI Used Against Remote Host to Enumerate or Dump Data (Linux)

ATT&CK T1530

redis-cli on Linux targeting a non-local host with enumeration or dump commands, indicating access to an exposed Redis database. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Redis CLI Used Against Remote Host to Enumerate or Dump Data (Linux)
description: Detects redis-cli executed with a remote host argument (-h) together
  with enumeration or dump commands such as KEYS, INFO, CONFIG GET, SCAN, --bigkeys.
  Matches reading data from an unauthenticated or overpermissive Redis instance on
  an adjacent network.
tags:
- attack.discovery
- attack.collection
- attack.t1526
- attack.t1530
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /redis-cli
  selection_remote:
    CommandLine|contains: ' -h '
  selection_cmd:
    CommandLine|contains:
    - ' keys '
    - ' info'
    - config get
    - ' scan'
    - --scan
    - --bigkeys
    - ' dump '
    - ' hgetall'
  filter_local:
    CommandLine|contains:
    - -h 127.0.0.1
    - -h localhost
    - -h ::1
  condition: selection_img and selection_remote and selection_cmd and not filter_local
falsepositives:
- Administrators checking replication or health of remote Redis nodes
- Automated monitoring agents invoking redis-cli INFO against cluster members
level: medium
id: 6be57bd8-cb4c-5795-bf72-72ee53958b9b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-252-08

Scripting or Netcat Tool Connecting to Redis Port 6379 on Remote Host

ATT&CK T1526

Scripting runtimes or raw socket tools connecting to TCP 6379 on a non-loopback host, which may indicate probing or direct access to an exposed Redis service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Scripting or Netcat Tool Connecting to Redis Port 6379 on Remote Host
description: Detects PowerShell, Python, netcat or redis-cli making outbound connections
  to TCP port 6379 on non-loopback addresses. Such tools are used to discover and
  query unauthenticated Redis instances on adjacent networks. Applications with legitimate
  Redis clients should be baselined.
tags:
- attack.discovery
- attack.t1526
- attack.collection
- attack.t1530
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 6379
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \python.exe
    - \pythonw.exe
    - \nc.exe
    - \ncat.exe
    - \redis-cli.exe
  filter_loopback:
    DestinationIp|cidr:
    - 127.0.0.0/8
    - ::1/128
  condition: selection and not filter_loopback
falsepositives:
- Developers running Python applications that use a Redis client against a shared
  dev or test server
- Administrative PowerShell or Python scripts that check Redis availability
level: medium
id: 279d9c80-9db5-5ff5-ac42-ac806aa76849
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-252-08

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-252-08

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account What it costs