Security Analysis of a Beckhoff CX-9020 Programmable Logic Controller

Abstract: While ICS units like PLCs and RTUs have been around a long time, introducing them into new environments like smart cities solutions, introduces new challenges unique to those environments. The devices are continuously gathering sensor data such as temperature and pressure, to make decisions on how to control different units, as well as sending the data to a central system that can monitor all buildings. This report has evaluated an implementation of a Beckhoff CX-9020 PLC and a web- port SCADA system. The evaluation was performed using a method with a focus on IoT implementations. No new vulnerabilities were reported, but previously discovered vulnerabilities, and problems with the device’s security configurations were found to be present. It was concluded that most of the vulnerabilities could be fixed by either keeping the devices up to date or making sure the correct configurations are used.