# Get Thee From BGP Rockwell: Ethernet/IP Is not Internet

- Link: https://www.agilicus.com/get-thee-from-bgp-rockwell-ethernet-ip-is-not-internet/
- Published: 2024-05-22T15:35:04+00:00
- Author: Don Bowman

Rockwell Automation has issued an urgent [directive](https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1672.html)“
IMPORTANT NOTICE: Rockwell Automation Reiterates Customer Guidance to Disconnect
Devices from the Internet to Protect from Cyber Threats”.

Amongst the reasons given (other than the obvious, these devices have negligible
security, control things which might be dangerous) are these CVE. But really, this
is just a starting point, you need a firewall that confirms identity between the
PLC and the net, in both directions.

| **CVE ID** | **Advisory** | 
| CVE-2021-22681 | [CISA | Rockwell Automation Logix Controllers (Update A)](https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03) | 
| CVE-2022-1159 | [CISA | Rockwell Automation Studio 5000 Logix Designer](https://www.cisa.gov/news-events/ics-advisories/icsa-22-090-07) | 
| CVE-2023-3595 | [CISA | Rockwell Automation Select Communication Modules](https://www.cisa.gov/news-events/ics-advisories/icsa-23-193-01) | 
| CVE-2023-46290 | [CISA | Rockwell Automation FactoryTalk Services Platform](https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-06) | 
| CVE-2024-21914 | [CISA | Rockwell Automation FactoryTalk View ME](https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-04) | 
| CVE-2024-21915 | [CISA | Rockwell Automation FactoryTalk Service Platform](https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-16) | 
| CVE-2024-21917 | [CISA | Rockwell Automation FactoryTalk Service Platform](https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-06) |

This got me thinking, surely no one would do that, right? One second, let me duck
into [Shodan.io](http://shodan.io) and see. OK, people do. The ‘myvzw’ is a Verizon
sim card or Mifi type device. The one below is same but for AT&T. Indeed you can
directly operate these PLC’s from the public Internet without any security, any 
authentication, any authorisation.

![plc-internet](https://www.agilicus.com/www/95c9e2f5-image-1024x628.png)

In “[Howto: Open Source Intelligence and your Digital Footprint](https://www.agilicus.com/howto-open-source-intelligence-and-your-digital-footprint/)”
I show some of the techniques you can use.