The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of multiple critical industrial control system (ICS) vulnerabilities, dubbed “Crit.IX”. The flaws impact Honeywell’s Experion Distributed Control System (DCS) platform deployed in factories across the globe including power plants, chemical plants, automotive manufacturing, and agricultural production operations. This exploit is made possible by nine (9) flaws (seven (7) of them deemed “critical”) impacting Honeywell’s proprietary protocol known as Control Data Access (CDA), designed to facilitate communication between Experion Servers and C300 controllers. The vulnerabilities include “Heap-based Buffer Overflow, Stack-based Buffer Overflow, Out-of-bounds Write, Uncontrolled Resource Consumption, Improper Encoding or Escaping of Output, Deserialization of Untrusted Data, Improper Input Validation, and Incorrect Comparison”. If successfully exploited, these flaws could enable unauthenticated attackers to conduct remote code execution (RCE), allowing for the complete takeover of the impacted DCS controller devices. This would allow the threat actors to impersonate the controller and/or server, altering the DCS operations while also hiding evidence of any malicious activity from the administrators and systems managing the controllers. This could allow state-sponsored threat groups who have compromised IT, IoT, and OT assets on the same network as the DCS devices to sabotage the systems, halting all operations. Armis Security researchers, who initially reported the vulnerabilities, have reported that in “the disclosure process we learned that due to reuse of the vulnerable code in other products, the vulnerabilities also affect Honeywell’s LX and PlantCruise platforms.” To mitigate the imminent threat of exploitation, Honeywell recommends that users upgrade their Experion Platforms to version R520.2. These vulnerabilities are not isolated incidents and represent fundamental flaws in the way that ICS infrastructure has been developed in the past. It is likely that some of the patched vulnerabilities can still be exploited with other techniques. CTIX analysts recommend that all organizations affected by these vulnerabilities follow security best practices recommended by Honeywell for Experion devices. These best practices can be found detailed in the Armis Security report and CISA advisory linked below. CTIX analysts will continue to monitor this matter and may publish updates in future FLASH reports as the situation develops.