FKIE_CVE-2020-6998

Vulnerability from fkie_nvd - Published: 2022-07-27 21:15 - Updated: 2026-06-17 03:24
Severity
5.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Summary
The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creating an infinite loop. This may allow an attacker to send specially crafted CIP packet requests to a controller, which may cause denial-of-service conditions in communications with other products.
References
ics-cert@hq.dhs.govhttps://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398Permissions Required, Vendor Advisory
ics-cert@hq.dhs.govhttps://www.cisa.gov/uscert/ics/advisories/icsa-21-061-02Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398Permissions Required, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-02Third Party Advisory, US Government Resource
Impacted products
Vendor Product Version
rockwellautomation armor_compact_guardlogix_5370_firmware *
rockwellautomation armor_compact_guardlogix_5370 -
rockwellautomation compact_guardlogix_5370_firmware *
rockwellautomation compact_guardlogix_5370 -
rockwellautomation compactlogix_5370_l1_firmware *
rockwellautomation compactlogix_5370_l1 -
rockwellautomation compactlogix_5370_l2_firmware *
rockwellautomation compactlogix_5370_l2 -
rockwellautomation compactlogix_5370_l3_firmware *
rockwellautomation compactlogix_5370_l3 -
rockwellautomation controllogix_5570_firmware *
rockwellautomation controllogix_5570 -
rockwellautomation guardlogix_5560_firmware *
rockwellautomation guardlogix_5560 -
rockwellautomation guardlogix_5570_firmware *
rockwellautomation guardlogix_5570 -
rockwellautomation guardlogix_5580_firmware *
rockwellautomation guardlogix_5580 -
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "Armor Compact GuardLogix 5370 controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "versions 33 and prior",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Armor GuardLogix Safety Controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "versions 33 and prior",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "CompactLogix 5370 L1 controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "versions 33 and prior",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "CompactLogix 5370 L2 controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "versions 33 and prior",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "CompactLogix 5370 L3 controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "versions 33 and prior",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Compact GuardLogix 5370 controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "versions 33 and prior",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "ControlLogix 5570 controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "versions 33 and prior",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "ics-cert@hq.dhs.gov"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:armor_compact_guardlogix_5370_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "13D07CA5-B2C0-483D-A183-60BAD0F6BA65",
              "versionEndIncluding": "33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:armor_compact_guardlogix_5370:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "03FAA30B-C345-4DD4-A686-50989ADF4CC5",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:compact_guardlogix_5370_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "797BDE9D-193A-4D9B-A38C-B199C99CE958",
              "versionEndIncluding": "33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:compact_guardlogix_5370:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F951670-AF4D-4429-8BC1-79BDEF83B2C3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:compactlogix_5370_l1_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "02304C1E-786D-4281-8854-6B626F201A29",
              "versionEndIncluding": "33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:compactlogix_5370_l1:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "848B3145-24E4-445B-958A-4C3F84C4546C",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:compactlogix_5370_l2_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "786B2806-A81A-4160-804A-AE9B2C445D65",
              "versionEndIncluding": "33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:compactlogix_5370_l2:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "65092726-5567-488C-9E32-DC42D34E111D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:compactlogix_5370_l3_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "4274AF4D-445F-454D-8B08-B03B39A5AD5F",
              "versionEndIncluding": "33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:compactlogix_5370_l3:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "52C2F377-6F0D-4752-A4A3-C40604A8575D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:controllogix_5570_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "235662B8-4F63-4D1F-9091-8271B85BDB17",
              "versionEndIncluding": "33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:controllogix_5570:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "482E2CD6-D484-486C-92F4-18432D107E30",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:guardlogix_5560_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC99B037-69C1-4475-B65E-046CA020806A",
              "versionEndIncluding": "33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:guardlogix_5560:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A42D9BC-9468-479A-873D-52175687FCBD",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:guardlogix_5570_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA97F17B-E8B2-4FF6-A8D8-69D8F6B17F2F",
              "versionEndIncluding": "33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:guardlogix_5570:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "321AE938-192A-4342-8608-ADC81F0B6582",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:rockwellautomation:guardlogix_5580_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A56F5CA1-02BF-4AC2-9963-F09E8390EC92",
              "versionEndIncluding": "33",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:rockwellautomation:guardlogix_5580:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "006B7683-9FDF-4748-BA28-2EA22613E092",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creating an infinite loop. This may allow an attacker to send specially crafted CIP packet requests to a controller, which may cause denial-of-service conditions in communications with other products."
    },
    {
      "lang": "es",
      "value": "El algoritmo de establecimiento de conexi\u00f3n encontrado en Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versiones 33 y anteriores, no administra suficientemente su flujo de control durante la ejecuci\u00f3n, creando un bucle infinito. Esto puede permitir a un atacante enviar peticiones de paquetes CIP especialmente dise\u00f1ados a un controlador, lo que puede causar condiciones de denegaci\u00f3n de servicio en las comunicaciones con otros productos"
    }
  ],
  "id": "CVE-2020-6998",
  "lastModified": "2026-06-17T03:24:05.747",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "ics-cert@hq.dhs.gov",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2020-6998",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-04-17T14:34:30.818711Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2022-07-27T21:15:08.297",
  "references": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398"
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-02"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Permissions Required",
        "Vendor Advisory"
      ],
      "url": "https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-02"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.