Skip to main content

Compactlogix 5380 Firmware CVE-2024-7507

HIGH
Improper Input Validation (CWE-20)
2024-08-14 PSIRT@rockwellautomation.com
8.7
CVSS 4.0 · Vendor: rockwellautomation
Share

Severity by source

Vendor (rockwellautomation) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (rockwellautomation) · only source for this CVE.

CVSS VectorVendor: rockwellautomation

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Aug 14, 2024 - 20:15 cve.org
HIGH 8.7

DescriptionCVE.org

CVE-2024-7507 IMPACT

A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.

AnalysisAI

CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller. Affected products include: Rockwellautomation Compactlogix 5380 Firmware, Rockwellautomation Controllogix 5580 Firmware, Rockwellautomation Guardlogix 5580 Firmware, Rockwellautomation Compact Guardlogix 5380 Sil 2 Firmware, Rockwellautomation Compact Guardlogix 5380 Sil 3 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

CVE-2022-1161 CRITICAL
9.8 Apr 11

An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, a

CVE-2024-6207 HIGH
8.7 Oct 14

CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a

CVE-2024-8626 HIGH
8.7 Oct 08

Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. Rated high

CVE-2024-6077 HIGH
8.7 Sep 12

A denial-of-service vulnerability exists in the Rockwell Automation affected products when specially crafted packets are

CVE-2024-7515 HIGH
8.7 Aug 14

CVE-2024-7515 IMPACT A denial-of-service vulnerability exists in the affected products. Rated high severity (CVSS 8.7),

CVE-2022-1797 HIGH
8.6 Jun 02

A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition

CVE-2024-5659 HIGH
8.3 Jun 14

Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result

CVE-2024-3493 HIGH
7.5 Apr 15

A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send larg

CVE-2022-3752 HIGH
7.5 Dec 19

An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading

CVE-2022-1159 HIGH
7.2 Apr 01

Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator

CVE-2017-6024 MEDIUM
5.9 May 06

A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011, V28.012, and V2

Share

CVE-2024-7507 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy