Rockwell Automation Micro800 PLCs vulnerable to RCE
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical remote code execution flaws in Rockwell Automation Micro800 PLCs via Azure RTOS dependencies and input validation; patch to V23.011.
Rockwell Automation Micro800 programmable logic controllers (Micro820, Micro850, Micro870 series) contain four critical vulnerabilities enabling remote code execution and privilege escalation. Three CVEs (CVE-2023-48691, CVE-2023-48692, CVE-2023-48693) stem from vulnerable Azure RTOS components—NetX Duo TCP/IP stack and ThreadX RTOS—that allow out-of-bounds writes, memory overflows, and arbitrary read/write operations. A fourth vulnerability (CVE-2025-7693) involves improper validation of malformed CIP Forward Close packets causing the controller to enter a fault state and become unresponsive. All four vulnerabilities carry CVSS v4 scores of 9.3 (network-accessible, low attack complexity, no authentication required), making them remotely exploitable with significant impact to confidentiality, integrity, and availability.
Affected firmware versions vary by model: Micro820 LC20 all versions prior to V14.011; Micro850 LC50 and Micro870 LC70 all versions prior to V12.013; Micro850 L50E and Micro870 L70E versions V20.011 through V22.011 (the latter two also affected by CVE-2025-7693). These devices are deployed across critical infrastructure sectors including chemical, energy, manufacturing, food and agriculture, transportation, and water systems worldwide. Rockwell Automation has not reported active exploitation in the wild as of August 2025, but patches are forthcoming with target release in September 2025. Organizations must prioritize network isolation, access controls, and monitoring for malformed CIP packets until patched firmware is available.
Mentioned in this report
Detection guidance
Scripting or Living-off-the-Land Process Connecting to EtherNet/IP CIP Port 44818
Interpreter or shell processes opening outbound connections to TCP/44818 (EtherNet/IP CIP), which could indicate scripted probing or exploitation of Micro800 PLCs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scripting or Living-off-the-Land Process Connecting to EtherNet/IP CIP Port
44818
id: 6e865900-5ac8-5c50-ab4a-a148ca9e678e
status: experimental
description: Detects interpreters and shells (python, powershell, cmd, node, perl,
ruby, wscript, cscript, mshta) initiating outbound connections to TCP/44818 (EtherNet/IP
explicit messaging, CIP). Custom CIP tooling such as malformed Forward Close packets
or exploit code for Micro800 PLC flaws (CVE-2025-7693 and the Azure RTOS CVEs) is
usually driven from scripts, not engineering software.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-25
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1499.004
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 44818
Image|endswith:
- \python.exe
- \pythonw.exe
- \py.exe
- \powershell.exe
- \pwsh.exe
- \cmd.exe
- \node.exe
- \perl.exe
- \ruby.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
condition: selection
falsepositives:
- OT engineers or integrators using Python CIP libraries for legitimate PLC data collection
or testing
- Authorised ICS vulnerability scanning performed from scripts
level: medium
author: Vorant
Non-Rockwell Process Connecting to EtherNet/IP CIP Port 44818
Windows process other than known Rockwell engineering or OPC software connecting to TCP/44818, which could indicate unauthorised CIP communication with PLCs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-Rockwell Process Connecting to EtherNet/IP CIP Port 44818
id: 44f98c6e-2a40-5ded-b16f-5c679c6335af
status: experimental
description: Detects Windows processes initiating connections to TCP/44818 (CIP) that
are not located in standard Rockwell Automation or common ICS software directories.
Unexpected hosts or binaries speaking CIP to Micro800 PLCs may be exploiting unauthenticated
remote flaws (malformed CIP Forward Close, NetX Duo/ThreadX memory corruption).
Tune the filter to the local engineering toolset.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-25
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1499.004
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 44818
filter_rockwell:
Image|contains:
- \Rockwell Software\
- \Rockwell Automation\
- \RSLinx\
- \Connected Components Workbench\
filter_system:
Image|startswith: C:\Windows\System32\svchost.exe
condition: selection and not 1 of filter_*
falsepositives:
- Third-party SCADA, historian or OPC servers polling PLCs over EtherNet/IP
- Asset-discovery or network monitoring tools that probe CIP devices
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-25
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs