Vulnerability · Published Dec 16, 2022 · Assigned by Rockwell
CVE-2022-3157Rockwell Automation GuardLogix and ControlLogix controllers Vulnerable to Denial-Of-Service Attack
High 8.6
In plain English
A high-severity improper input validation in Compact GuardLogix from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.1)8.6High
Exploit odds (30 days)1.5%top 25.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-of-service condition (DOS).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | CompactLogix 5370 | 20 – through 33 |
| Rockwell Automation | Compact GuardLogix | 28 – through 33 |
| Rockwell Automation | ControlLogix 5570 | 20 – through 33 |
| Rockwell Automation | ControlLogix 5570 Redundancy | 20 – through 33 |
| Rockwell Automation | GuardLogix 5570 | 20 – through 33 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H