EtherNet/IP (CIP) Security

EtherNet/IP (Ethernet Industrial Protocol) uses the Common Industrial Protocol (CIP) transported over standard IEEE 802.3 Ethernet. Developed by Rockwell Automation and standardised by ODVA, it is the dominant industrial protocol in North American discrete manufacturing, automotive, food & beverage, and life sciences. It operates on port 44818/TCP (explicit messaging) and port 2222/UDP (implicit I/O messaging).

CIP Services

CIP defines device objects (Identity Object, Assembly Object, Connection Manager) accessible via explicit messaging. The Identity Object (class 0x01, instance 1) returns vendor ID, product type, serial number, and firmware version — useful reconnaissance data requiring no authentication to access.

Security Vulnerabilities

• Unauthenticated explicit messaging — CIP Set_Attribute services modify device parameters with no credential check
• Identity Object disclosure — vendor, product name, firmware version retrievable by any host on the network
• Implicit I/O spoofing — UDP-based I/O connections can be hijacked or spoofed to inject false process data
• CIP Safety attacks — without CIP Security, safety-rated process data is unprotected; spoofed safety signals may disable safety functions
• Denial of service — connection table exhaustion by opening maximum concurrent CIP connections blocks legitimate SCADA access

CIP Security (2018)

CIP Security adds TLS 1.2+ for explicit TCP messaging and DTLS 1.2 for UDP implicit messaging. Authentication uses pre-shared keys or X.509 certificates. Device identity is enforced via a Device Certificate issued by the plant PKI. CIP Security also defines an Authorization Policy allowing fine-grained control over which clients can access which CIP objects.

Defences