PT-2017-16840 · Rockwell Automation · Compactlogix 5380+1

Publicado 2017-05-06 · Atualizado 2022-03-23 · CVE-2017-6024

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation ControlLogix 5580 controllers versions V28.011 through V28.013 Rockwell Automation ControlLogix 5580 controllers version V29.011 Rockwell Automation CompactLogix 5380 controllers version V28.011 Rockwell Automation CompactLogix 5380 controllers version V29.011

Description A Resource Exhaustion issue may allow an attacker to cause a denial of service condition by sending a series of specific CIP-based commands to the controller.

Recommendations For Rockwell Automation ControlLogix 5580 controllers versions V28.011 through V28.013, update to a version that includes a fix for this issue. For Rockwell Automation ControlLogix 5580 controllers version V29.011, update to a version that includes a fix for this issue. For Rockwell Automation CompactLogix 5380 controllers version V28.011, update to a version that includes a fix for this issue. For Rockwell Automation CompactLogix 5380 controllers version V29.011, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the CIP-based commands to minimize the risk of exploitation.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2017-6024

Produtos afetados

Compactlogix 5380

Controllogix 5580

Referências · 4

• http://securityfocus.com/bid/98309 · Nota
• https://osv.dev/vulnerability/CVE-2017-6024 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-17-094-05 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6024 · Nota de Segurança