Vulnerabilites related to Rockwell Automation - GuardLogix 5580 (1756-L8z)
cve-2024-7507
Vulnerability from cvelistv5
Published
2024-08-14 19:35
Modified
2024-08-15 14:37
Severity ?
EPSS score ?
Summary
CVE-2024-7507 IMPACT
A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Rockwell Automation | CompactLogix 5380 (5069 – L3z) |
Version: 28.011 |
|||||||||||||||||||||
|
||||||||||||||||||||||||
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:o:rockwellautomation:controllogix_5380_firmware:28.011:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "controllogix_5380_firmware", vendor: "rockwellautomation", versions: [ { status: "affected", version: "28.011", }, ], }, { cpes: [ "cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:28.011:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "controllogix_5580_firmware", vendor: "rockwellautomation", versions: [ { status: "affected", version: "28.011", }, ], }, { cpes: [ "cpe:2.3:o:rockwellautomation:guardlogix_5580_firmware:28.011:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "guardlogix_5580_firmware", vendor: "rockwellautomation", versions: [ { status: "affected", version: "28.011", }, ], }, { cpes: [ "cpe:2.3:o:rockwellautomation:compact_guardlogix_5380_firmware:28.011:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "compact_guardlogix_5380_firmware", vendor: "rockwellautomation", versions: [ { status: "affected", version: "28.011", }, ], }, { cpes: [ "cpe:2.3:o:rockwellautomation:compactlogix_5480_firmware:28.011:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "compactlogix_5480_firmware", vendor: "rockwellautomation", versions: [ { status: "affected", version: "28.011", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-7507", options: [ { Exploitation: "none", }, { Automatable: "yes", }, { "Technical Impact": "partial", }, ], role: "CISA Coordinator", timestamp: "2024-08-15T14:32:59.595579Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-08-15T14:37:58.421Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, ], cna: { affected: [ { defaultStatus: "unaffected", product: "CompactLogix 5380 (5069 – L3z)", vendor: "Rockwell Automation", versions: [ { status: "affected", version: "28.011", }, ], }, { defaultStatus: "unaffected", product: "ControlLogix® 5580 (1756 –L8z)", vendor: "Rockwell Automation", versions: [ { status: "affected", version: "28.011", }, ], }, { defaultStatus: "unaffected", product: "GuardLogix 5580 (1756-L8z)", vendor: "Rockwell Automation", versions: [ { status: "affected", version: "28.011", }, ], }, { defaultStatus: "unaffected", product: "Compact GuardLogix 5380 (5069- L3zS2)", vendor: "Rockwell Automation", versions: [ { status: "affected", version: "28.011", }, ], }, { defaultStatus: "unaffected", product: "CompactLogix 5480 (5069-L4)", vendor: "Rockwell Automation", versions: [ { status: "affected", version: "28.011", }, ], }, ], datePublic: "2024-08-13T13:00:00.000Z", descriptions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<p><b><u>CVE-2024-7507 IMPACT</u></b></p><p>A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.</p>", }, ], value: "CVE-2024-7507 IMPACT\n\nA denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.", }, ], impacts: [ { capecId: "CAPEC-153", descriptions: [ { lang: "en", value: "CAPEC-153 Input Data Manipulation", }, ], }, ], metrics: [ { cvssV4_0: { Automatable: "NOT_DEFINED", Recovery: "NOT_DEFINED", Safety: "NOT_DEFINED", attackComplexity: "LOW", attackRequirements: "NONE", attackVector: "NETWORK", baseScore: 8.7, baseSeverity: "HIGH", privilegesRequired: "NONE", providerUrgency: "NOT_DEFINED", subAvailabilityImpact: "NONE", subConfidentialityImpact: "NONE", subIntegrityImpact: "NONE", userInteraction: "NONE", valueDensity: "NOT_DEFINED", vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", version: "4.0", vulnAvailabilityImpact: "HIGH", vulnConfidentialityImpact: "NONE", vulnIntegrityImpact: "NONE", vulnerabilityResponseEffort: "NOT_DEFINED", }, format: "CVSS", scenarios: [ { lang: "en", value: "GENERAL", }, ], }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-20", description: "CWE-20 Improper Input Validation", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-08-14T19:35:55.326Z", orgId: "b73dd486-f505-4403-b634-40b078b177f0", shortName: "Rockwell", }, references: [ { url: "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201685.html", }, ], solutions: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<p>Upgrade to: \n\n<span style=\"background-color: rgb(255, 255, 255);\">v36.011, v35.013, v34.014 </span><span style=\"background-color: rgb(255, 255, 255);\"><br>\n\n<br></span></p>", }, ], value: "Upgrade to: \n\nv36.011, v35.013, v34.014", }, ], source: { discovery: "INTERNAL", }, title: "Rockwell Automation ControlLogix/GuardLogix 5580 and CompactLogix/Compact GuardLogix® 5380 Controller Denial-of-Service Vulnerability via Input Validation", workarounds: [ { lang: "en", supportingMedia: [ { base64: false, type: "text/html", value: "<span style=\"background-color: rgb(255, 255, 255);\">Restrict communication to CIP object 103 (0x67)</span>\n\n<br>", }, ], value: "Restrict communication to CIP object 103 (0x67)", }, ], x_generator: { engine: "Vulnogram 0.2.0", }, }, }, cveMetadata: { assignerOrgId: "b73dd486-f505-4403-b634-40b078b177f0", assignerShortName: "Rockwell", cveId: "CVE-2024-7507", datePublished: "2024-08-14T19:35:55.326Z", dateReserved: "2024-08-05T20:04:40.970Z", dateUpdated: "2024-08-15T14:37:58.421Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }