The US Cybersecurity and Infrastructure Security Agency (CISA) has warned of two (2) critical vulnerabilities affecting Rockwell Automation programmable logic controllers (PLC), which if exploited could allow malicious threat actors to escalate their local privileges, modify user applications, and inject undetectable logic controller bytecode (tracked as CVE-2022-1161 and CVE 2022-1159). Analysts have compared these vulnerabilities to similar ones exploited in the infamous 2010 Stuxnet worm malware attacks, which were unprecedented at the time, and caused massive damage to critical infrastructure (CIS) in Iran’s nuclear and other energy sectors. Exploiting PLCs in CIS is extremely resource heavy and time-consuming, which points to the capabilities of hackers leveraging nation-state assets. Although the original Stuxnet malware was set to expire in 2012, legacy spinoffs known as “sons of Stuxnet,” have been steadily identified ever since. These exploits are so devastating because they often go completely undetected for sustained amounts of time, and engineers typically can’t identify them without the use of advanced forensics tools, or until it’s too late. The Ankura CTIX urges any and all users administrating Rockwell Automation PLCs to ensure they are running the most up-to-date version that patches these vulnerabilities. CISA has provided instructions for patching this flaw in their advisory linked below.