Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2024-7507

Summary
Assigner-Rockwell
Assigner Org ID-b73dd486-f505-4403-b634-40b078b177f0
Published At-14 Aug, 2024 | 19:35
Updated At-15 Aug, 2024 | 14:37
Rejected At-
Credits

Rockwell Automation ControlLogix/GuardLogix 5580 and CompactLogix/Compact GuardLogix® 5380 Controller Denial-of-Service Vulnerability via Input Validation

CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:Rockwell
Assigner Org ID:b73dd486-f505-4403-b634-40b078b177f0
Published At:14 Aug, 2024 | 19:35
Updated At:15 Aug, 2024 | 14:37
Rejected At:
▼CVE Numbering Authority (CNA)
Rockwell Automation ControlLogix/GuardLogix 5580 and CompactLogix/Compact GuardLogix® 5380 Controller Denial-of-Service Vulnerability via Input Validation

CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.

Affected Products
Vendor
Rockwell Automation, Inc.Rockwell Automation
Product
CompactLogix 5380 (5069 – L3z)
Default Status
unaffected
Versions
Affected
  • 28.011
Vendor
Rockwell Automation, Inc.Rockwell Automation
Product
ControlLogix® 5580 (1756 –L8z)
Default Status
unaffected
Versions
Affected
  • 28.011
Vendor
Rockwell Automation, Inc.Rockwell Automation
Product
GuardLogix 5580 (1756-L8z)
Default Status
unaffected
Versions
Affected
  • 28.011
Vendor
Rockwell Automation, Inc.Rockwell Automation
Product
Compact GuardLogix 5380 (5069- L3zS2)
Default Status
unaffected
Versions
Affected
  • 28.011
Vendor
Rockwell Automation, Inc.Rockwell Automation
Product
CompactLogix 5480 (5069-L4)
Default Status
unaffected
Versions
Affected
  • 28.011
Problem Types
TypeCWE IDDescription
CWECWE-20CWE-20 Improper Input Validation
Type: CWE
CWE ID: CWE-20
Description: CWE-20 Improper Input Validation
Metrics
VersionBase scoreBase severityVector
4.08.7HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Version: 4.0
Base score: 8.7
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-153CAPEC-153 Input Data Manipulation
CAPEC ID: CAPEC-153
Description: CAPEC-153 Input Data Manipulation
Solutions

Upgrade to:  v36.011, v35.013, v34.014

Configurations
Workarounds

Restrict communication to CIP object 103 (0x67)

Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201685.html
N/A
Hyperlink: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201685.html
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Vendor
Rockwell Automation, Inc.rockwellautomation
Product
controllogix_5380_firmware
CPEs
  • cpe:2.3:o:rockwellautomation:controllogix_5380_firmware:28.011:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 28.011
Vendor
Rockwell Automation, Inc.rockwellautomation
Product
controllogix_5580_firmware
CPEs
  • cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:28.011:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 28.011
Vendor
Rockwell Automation, Inc.rockwellautomation
Product
guardlogix_5580_firmware
CPEs
  • cpe:2.3:o:rockwellautomation:guardlogix_5580_firmware:28.011:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 28.011
Vendor
Rockwell Automation, Inc.rockwellautomation
Product
compact_guardlogix_5380_firmware
CPEs
  • cpe:2.3:o:rockwellautomation:compact_guardlogix_5380_firmware:28.011:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 28.011
Vendor
Rockwell Automation, Inc.rockwellautomation
Product
compactlogix_5480_firmware
CPEs
  • cpe:2.3:o:rockwellautomation:compactlogix_5480_firmware:28.011:*:*:*:*:*:*:*
Default Status
unknown
Versions
Affected
  • 28.011
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:PSIRT@rockwellautomation.com
Published At:14 Aug, 2024 | 20:15
Updated At:04 Mar, 2025 | 17:11

CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.08.7HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.16.5MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Type: Secondary
Version: 4.0
Base score: 8.7
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 6.5
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CPE Matches
Rockwell Automation, Inc.
rockwellautomation
>>compactlogix_5380_firmware>>Versions from 28.011(inclusive) to 34.014(exclusive)
cpe:2.3:o:rockwellautomation:compactlogix_5380_firmware:*:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compactlogix_5380_firmware>>35.011
cpe:2.3:o:rockwellautomation:compactlogix_5380_firmware:35.011:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compactlogix_5380>>-
cpe:2.3:h:rockwellautomation:compactlogix_5380:-:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>controllogix_5580_firmware>>Versions from 28.011(inclusive) to 34.014(exclusive)
cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:*:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>controllogix_5580_firmware>>35.011
cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:35.011:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>controllogix_5580>>-
cpe:2.3:h:rockwellautomation:controllogix_5580:-:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>guardlogix_5580_firmware>>Versions from 31.011(inclusive) to 34.014(exclusive)
cpe:2.3:o:rockwellautomation:guardlogix_5580_firmware:*:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>guardlogix_5580_firmware>>35.011
cpe:2.3:o:rockwellautomation:guardlogix_5580_firmware:35.011:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>guardlogix_5580>>-
cpe:2.3:h:rockwellautomation:guardlogix_5580:-:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compact_guardlogix_5380_sil_2_firmware>>Versions from 31.011(inclusive) to 34.014(exclusive)
cpe:2.3:o:rockwellautomation:compact_guardlogix_5380_sil_2_firmware:*:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compact_guardlogix_5380_sil_2_firmware>>35.011
cpe:2.3:o:rockwellautomation:compact_guardlogix_5380_sil_2_firmware:35.011:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compact_guardlogix_5380_sil_2>>-
cpe:2.3:h:rockwellautomation:compact_guardlogix_5380_sil_2:-:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compact_guardlogix_5380_sil_3_firmware>>Versions from 32.013(inclusive) to 34.014(exclusive)
cpe:2.3:o:rockwellautomation:compact_guardlogix_5380_sil_3_firmware:*:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compact_guardlogix_5380_sil_3_firmware>>35.011
cpe:2.3:o:rockwellautomation:compact_guardlogix_5380_sil_3_firmware:35.011:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compact_guardlogix_5380_sil_3>>-
cpe:2.3:h:rockwellautomation:compact_guardlogix_5380_sil_3:-:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compactlogix_5480_firmware>>Versions from 32.011(inclusive) to 34.014(exclusive)
cpe:2.3:o:rockwellautomation:compactlogix_5480_firmware:*:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compactlogix_5480_firmware>>35.011
cpe:2.3:o:rockwellautomation:compactlogix_5480_firmware:35.011:*:*:*:*:*:*:*
Rockwell Automation, Inc.
rockwellautomation
>>compactlogix_5480>>-
cpe:2.3:h:rockwellautomation:compactlogix_5480:-:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-20SecondaryPSIRT@rockwellautomation.com
NVD-CWE-noinfoPrimarynvd@nist.gov
CWE ID: CWE-20
Type: Secondary
Source: PSIRT@rockwellautomation.com
CWE ID: NVD-CWE-noinfo
Type: Primary
Source: nvd@nist.gov
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201685.htmlPSIRT@rockwellautomation.com
Vendor Advisory
Hyperlink: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201685.html
Source: PSIRT@rockwellautomation.com
Resource:
Vendor Advisory

Change History

0
Information is not available yet

Similar CVEs

0Records found
Details not found