Enhancing Rockwell Automation Lifecycle Services through VMware Integration

1. EXECUTIVE SUMMARY

The integration of Rockwell Automation’s Lifecycle Services with VMware has unveiled critical vulnerabilities that pose significant risks to industrial data centers and related services. With a CVSS v4 score of 9.4, these vulnerabilities are characterized by low attack complexity and known public exploits, making them particularly concerning for organizations relying on these technologies. The affected products include various services such as the Industrial Data Center (IDC), Threat Detection Managed Services (TDMS), and Endpoint Protection Services, all of which utilize VMware technology. The vulnerabilities identified include Time-of-check Time-of-use (TOCTOU) Race Condition, Write-what-where Condition, and Out-of-bounds Read, each allowing potential code execution by attackers with local administrative privileges. This report aims to provide a comprehensive analysis of these vulnerabilities, their implications, and recommended mitigations.

2. RISK EVALUATION

The successful exploitation of the identified vulnerabilities could enable an attacker with local administrative privileges to execute arbitrary code. This level of access can lead to severe consequences, including unauthorized control over critical systems, data breaches, and potential disruptions to manufacturing processes. Given the critical nature of the sectors utilizing Rockwell Automation’s services, the implications of these vulnerabilities extend beyond individual organizations to potentially impact supply chains and national security.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Rockwell Automation Lifecycle Services with VMware are affected:

Industrial Data Center (IDC) with VMware: Generations 1 through 4
VersaVirtual Appliance (VVA) with VMware: Series A and B
Threat Detection Managed Services (TDMS) with VMware: All versions
Endpoint Protection Service with RA Proxy & VMware: All versions
Engineered and Integrated Solutions with VMware: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 TIME-OF-CHECK TIME-OF-USE (TOCTOU) RACE CONDITION CWE-367

A TOCTOU vulnerability exists in VMware ESXi, which is utilized by the affected products. Exploitation of this vulnerability can allow a threat actor with local administrative privileges to execute code as the virtual machine’s VMX process running on the host. This vulnerability has been assigned CVE-2025-22224, with a CVSS v3.1 base score of 9.3 and a CVSS v4 score of 9.4.

3.2.2 WRITE-WHAT-WHERE CONDITION CWE-123

A code execution vulnerability also exists in VMware ESXi, allowing a threat actor with privileges within the VMX process to trigger an arbitrary kernel write, leading to a sandbox escape. This vulnerability is identified as CVE-2025-22225, with a CVSS v3.1 base score of 8.2 and a CVSS v4 score of 9.3.

3.2.3 OUT-OF-BOUNDS READ CWE-125

An out-of-bounds vulnerability in VMware ESXi allows a threat actor with administrative privileges to leak memory from the VMX process. This vulnerability is cataloged as CVE-2025-22226, with a CVSS v3.1 base score of 7.1 and a CVSS v4 score of 8.2.

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Rockwell Automation has proactively reported these vulnerabilities to the Cybersecurity and Infrastructure Security Agency (CISA), demonstrating a commitment to transparency and user safety.

4. MITIGATIONS

Rockwell Automation is set to contact impacted users to discuss necessary remediation actions. For users without a managed services contract, guidance is available through Broadcom’s advisories. Key resources include:

Organizations using the affected software who cannot upgrade are encouraged to apply security best practices. CISA recommends the following defensive measures:

Minimize network exposure: Ensure control system devices are not accessible from the Internet.
Isolate networks: Place control system networks behind firewalls and separate from business networks.
Secure remote access: Use VPNs for remote access, while recognizing their vulnerabilities and ensuring they are updated.

CISA emphasizes the importance of conducting proper impact analysis and risk assessments before implementing defensive measures. Additional resources for cybersecurity strategies are available on CISA’s ICS webpage, including best practices for proactive defense of ICS assets.

5. UPDATE HISTORY

March 18, 2025: Initial Publication

In conclusion, the vulnerabilities identified in Rockwell Automation’s Lifecycle Services integrated with VMware present significant risks that require immediate attention. Organizations must prioritize remediation efforts and adopt robust cybersecurity practices to safeguard their critical infrastructure against potential exploitation.