CyberzSOC

Publication detail
← Back to advisories & guidance

ICSA-24-030-05: Rockwell Automation ControlLogix and GuardLogix ↗ source

January 30, 2024 CISA ICS Advisory
Source: https://www.cisa.gov/news-events/ics-advisories/icsa-24-030-05

Summary

Successful exploitation of this vulnerability could allow an attacker to crash the device by exploiting a Denial-of-Service (DoS) vulnerability. CVE-2024-21916: A Denial-of-Service (DoS) vulnerability exists in the affected products, listed above. If exploited, the product could potentially experience a major nonrecoverable fault (MNRF). The device will restart itself to recover from the MNRF.

Advisory Details CISA ICS CSAF feed

Advisory ID
ICSA-24-030-05
Status
Final · version 1
Initial release
2024-01-30
Last revised
2024-01-30
Vendor
Rockwell Automation
Critical infrastructure sectors
Critical Manufacturing
Deployed
Worldwide
Vendor headquarters
United States

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

Credit: Rockwell Automation

Affected products (3)
  • ControlLogix 5570 — Firmware__20.011
  • ControlLogix 5570 redundant — Firmware__20.054_kit1
  • GuardLogix 5570 — Firmware__20.011

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVEWeaknessCVSS v3Details
CVE-2024-21916 CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer 8.6 High A Denial-of-Service (DoS) vulnerability exists in the affected products, listed above. If exploited, the product could potentially experience a major nonrecoverable fault (MNRF). The device will restart itself to recover from the MNRF.

Mitigation: Rockwell Automation users with the affected software are encouraged to apply the risk mitigations, if possible. Additionally, Rockwell Automation encourages users to implement their suggested security best practices to minimize the risk of vulnerability.

Vendor fix: ControlLogix 5570: Corrected in v33.016, 34.013, 35.012, 36.011 and later

Vendor fix: ControlLogix 5570 redundant: Corrected in v33.053_kit1, 34.052_kit1, 35.052_kit1, 36.051_kit1 and later

Affected, fixed & timeline

Affected:

  • ControlLogix 5570 Firmware__20.011
  • ControlLogix 5570 redundant Firmware__20.054_kit1
  • GuardLogix 5570 Firmware__20.011

Vendor fix: GuardLogix 5570: Corrected in v33.016, 34.013, 35.012, 36.011 and later

Mitigation: For more information, see Rockwell Automation's security advisory.

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2024-21916 8.6 High Rockwell Automation ControlLogix® 5570 A denial-of-service vulnerability exists in specific Rockwell Automation ControlLogix ang GuardLogix controllers. If exploited, the product could po…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Rockwell 1 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.