cnvd - cnvd-2024-16842

CNVD-2024-16842

Vulnerability from cnvd - Published: 2024-04-07

Title

Rockwell Automation 1756 EN2 and 1756 EN3拒绝服务漏洞

Description

Rockwell Automation 1756是美国罗克韦尔（Rockwell Automation）公司的一种可扩展的控制器解决方案。能够寻址大量I/O点。 Rockwell Automation 1756 EN2和1756 EN3存在拒绝服务漏洞，该漏洞源于未对输入的错误消息做正确的处理，攻击者可利用该漏洞通过恶意制作的CIP消息在目标系统上持久执行远程代码。

Severity

高

Patch Name

Rockwell Automation 1756 EN2 and 1756 EN3拒绝服务漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-3595

Impacted products

Name
['Rockwell Automation 1756 EN2', 'Rockwell Automation 1756 EN3']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-3595",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-3595"
    }
  },
  "description": "Rockwell Automation 1756\u662f\u7f8e\u56fd\u7f57\u514b\u97e6\u5c14\uff08Rockwell Automation\uff09\u516c\u53f8\u7684\u4e00\u79cd\u53ef\u6269\u5c55\u7684\u63a7\u5236\u5668\u89e3\u51b3\u65b9\u6848\u3002\u80fd\u591f\u5bfb\u5740\u5927\u91cfI/O\u70b9\u3002\n\nRockwell Automation 1756 EN2\u548c1756 EN3\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u5bf9\u8f93\u5165\u7684\u9519\u8bef\u6d88\u606f\u505a\u6b63\u786e\u7684\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6076\u610f\u5236\u4f5c\u7684CIP\u6d88\u606f\u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u6301\u4e45\u6267\u884c\u8fdc\u7a0b\u4ee3\u7801\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-16842",
  "openTime": "2024-04-07",
  "patchDescription": "Rockwell Automation 1756\u662f\u7f8e\u56fd\u7f57\u514b\u97e6\u5c14\uff08Rockwell Automation\uff09\u516c\u53f8\u7684\u4e00\u79cd\u53ef\u6269\u5c55\u7684\u63a7\u5236\u5668\u89e3\u51b3\u65b9\u6848\u3002\u80fd\u591f\u5bfb\u5740\u5927\u91cfI/O\u70b9\u3002\r\n\r\nRockwell Automation 1756 EN2\u548c1756 EN3\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u672a\u5bf9\u8f93\u5165\u7684\u9519\u8bef\u6d88\u606f\u505a\u6b63\u786e\u7684\u5904\u7406\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6076\u610f\u5236\u4f5c\u7684CIP\u6d88\u606f\u5728\u76ee\u6807\u7cfb\u7edf\u4e0a\u6301\u4e45\u6267\u884c\u8fdc\u7a0b\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Rockwell Automation 1756 EN2 and 1756 EN3\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Rockwell Automation 1756 EN2",
      "Rockwell Automation 1756 EN3"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-3595",
  "serverity": "\u9ad8",
  "submitTime": "2023-07-16",
  "title": "Rockwell Automation 1756 EN2 and 1756 EN3\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}

CVE-2023-3595 (GCVE-0-2023-3595)

Vulnerability from cvelistv5 – Published: 2023-07-12 12:37 – Updated: 2024-08-02 07:01

Summary

Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-787 - Out-of-bounds Write

Assigner

Rockwell

References

URL

Tags

https://rockwellautomation.custhelp.com/app/answe…

Impacted products

Vendor

Product

Version

Rockwell Automation

1756-EN2T Series A, B, C

Affected: <=5.008 & 5.028

Rockwell Automation	1756-EN2T Series D	Affected: <=11.003
Rockwell Automation	1756-EN2TK Series A, B, C	Affected: <=5.008 & 5.028
Rockwell Automation	1756-EN2TXT Series A, B, C	Affected: <=5.008 & 5.028
Rockwell Automation	1756-EN2TXT Series D	Affected: <=11.003
Rockwell Automation	1756-EN2TP Series A	Affected: <=11.003
Rockwell Automation	1756-EN2TPK Series A	Affected: <=11.003
Rockwell Auotmation	1756-EN2TPXT Series A	Affected: <=11.003
Rockwell Automation	1756-EN2TR Series A, B	Affected: <=5.008 & 5.028
Rockwell Automation	1756-EN2TR Series C	Affected: <=11.003
Rockwell Automation	1756-EN2TRK Series A, B	Affected: <=5.008 & 5.028
Rockwell Automation	1756-EN2TRK Series C	Affected: <=11.003
Rockwell Automation	1756-EN2TRXT Series A, B	Affected: <=5.008 & 5.028
Rockwell Automation	1756-EN2TRXT Series C	Affected: <=11.003
Rockwell Automation	1756-EN2F Series A, B	Affected: <=5.008 & 5.028
Rockwell Automation	1756-EN2F Series C	Affected: <=11.003
Rockwell Automation	1756-EN2FK Series A, B	Affected: <=5.008 & 5.028
Rockwell Automation	1756-EN2FK Series C	Affected: <=11.003
Rockwell Automation	1756-EN3TR Series A	Affected: <=5.008 & 5.028
Rockwell Automation	1756-EN3TR Series B	Affected: <=11.003
Rockwell Automation	1756-EN3TRK Series A	Affected: <=5.008 & 5.028
Rockwell Automation	1756-EN3TRK Series B	Affected: <=11.003

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T07:01:57.031Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2T Series A, B, C",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2T Series D",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TK Series A, B, C",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TXT Series A, B, C",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TXT Series D",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TP Series A",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TPK Series A",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TPXT Series A",
          "vendor": "Rockwell Auotmation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TR Series A, B",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TR Series C",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TRK Series A, B",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TRK Series C",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TRXT Series A, B",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2TRXT Series C",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2F Series A, B",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2F Series C",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2FK Series A, B",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN2FK Series C",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN3TR Series A",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN3TR Series B",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN3TRK Series A",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=5.008 \u0026 5.028"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1756-EN3TRK Series B",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c=11.003"
            }
          ]
        }
      ],
      "datePublic": "2023-07-12T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhere this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.\u003c/span\u003e\n\n"
            }
          ],
          "value": "\nWhere this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.\n\n"
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "CWE-787 Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-07-12T13:15:20.247Z",
        "orgId": "b73dd486-f505-4403-b634-40b078b177f0",
        "shortName": "Rockwell"
      },
      "references": [
        {
          "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\u003cul\u003e\u003cli\u003e\u003cstrong\u003eUpdate firmware.\u003c/strong\u003e\u0026nbsp;Update EN2* ControlLogix communications modules to mitigated firmware.\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eProperly segment networks.\u003c/strong\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp;Given a cyber actor would require network connectivity to the communication module to exploit the vulnerability, organizations should ensure ICS/SCADA networks are properly segmented within the process structure as well as from the Internet and other non-essential networks.\u003c/span\u003e\u003c/li\u003e\u003cli\u003e\u003cstrong\u003eImplement detection signatures.\u003c/strong\u003e\u003cspan style=\"background-color: var(--wht);\"\u003e\u0026nbsp;Use appended Snort signatures to monitor and detect anomalous Common Industrial Protocol (CIP) packets to Rockwell Automation devices.\u003c/span\u003e\u003c/li\u003e\u003c/ul\u003e\n\n"
            }
          ],
          "value": "\n  *  Update firmware.\u00a0Update EN2* ControlLogix communications modules to mitigated firmware.\n  *  Properly segment networks.\u00a0Given a cyber actor would require network connectivity to the communication module to exploit the vulnerability, organizations should ensure ICS/SCADA networks are properly segmented within the process structure as well as from the Internet and other non-essential networks.\n  *  Implement detection signatures.\u00a0Use appended Snort signatures to monitor and detect anomalous Common Industrial Protocol (CIP) packets to Rockwell Automation devices.\n\n\n\n\n"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
    "assignerShortName": "Rockwell",
    "cveId": "CVE-2023-3595",
    "datePublished": "2023-07-12T12:37:01.939Z",
    "dateReserved": "2023-07-10T15:34:52.031Z",
    "dateUpdated": "2024-08-02T07:01:57.031Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2024-16842

CVE-2023-3595 (GCVE-0-2023-3595)

Tags

Sightings

Nomenclature