Researchers said that their attack relies on getting root privileges on the PLC's operating system, which also implies achieving some sort of remote code execution state via a PLC firmware vulnerability.