CVE-2024-3493

15.04.2024, 22:15

A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send large amounts of data) can cause a major nonrecoverable fault (MNRF) Rockwell Automation's ControlLogix 5580, Guard Logix5580,CompactLogix 5380,and 1756-EN4TR. If exploited, the affected product will become unavailable and require a manual restart to recover it. Additionally, an MNRF could result in a loss of view and/or control of connected devices.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Rockwell	CNA	8.6 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 7%

Vendor	Product	Version
rockwellautomation	controllogix_5580_firmware	35.011
rockwellautomation	guardlogix_5580_firmware	35.011
rockwellautomation	compactlogix_5380_firmware	35.011
rockwellautomation	compact_guardlogix_5380_firmware	35.011
rockwellautomation	1756-en4tr_firmware	5.001
rockwellautomation	controllogix_5580_process_firmware	35.011
rockwellautomation	compactlogix_5380_process_firmware	35.011
rockwellautomation	compactlogix_5480_firmware	35.011

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://www.rockwellautomation.com/en-us/support/advisory.SD1666.html