PT-2024-8139 · Rockwell Automation · Compact Guardlogix 5380+6

Published 2024-10-07 · Updated 2024-10-10 · CVE-2024-8626

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Rockwell Automation products (affected versions not specified) ControlLogix 5580 versions (no specific range provided) GuardLogix 5580 versions (no specific range provided) CompactLogix 5380 versions (no specific range provided) CompactLogix 5480 versions (no specific range provided) Compact GuardLogix 5380 versions (no specific range provided) 1756-EN4TR versions (no specific range provided)

Description: A denial-of-service vulnerability exists in Rockwell Automation products due to a memory leak. This issue can be exploited by a malicious actor performing multiple actions on certain web pages, causing the products to become fully unavailable and require a power cycle to recover. The vulnerability is related to an uncontrolled resource consumption.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Memory Leak

Weakness Enumeration

CWE-400

CWE-401

Related Identifiers

BDU:2024-09680

CVE-2024-8626

Affected Products

1756-En4Tr

Compact Guardlogix 5380

Compactlogix 5380

Compactlogix 5480

Controllogix 5580

Guardlogix 5580

Rockwell Automation

References · 7

• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1706.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09680 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-8626 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8626 · Vendor Advisory
• https://t.me/cvedetector/7378 · Telegram Post
• https://twitter.com/CveFindCom/status/1843698155159761179 · Twitter Post
• https://twitter.com/CVEnew/status/1843694400720797770 · Twitter Post