Vulnerability · Published Aug 1, 2024 · Assigned by Rockwell
CVE-2024-6242Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices
High 7.3
In plain English
A high-severity security flaw in 1756-EN2F from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.1% (higher than 96% of all known vulnerabilities).
Official description
A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | ControlLogix® 5580 (1756-L8z) | V28 |
| Rockwell Automation | GuardLogix® 5580 (1756-L8zS) | V31 |
| Rockwell Automation | 1756-EN4TR | V2 |
| Rockwell Automation | 1756-EN2T | v5.007(unsigned)/v5.027(signed) |
| Rockwell Automation | 1756-EN2F | v5.007(unsigned)/v5.027(signed) |
| Rockwell Automation | 1756-EN2TR | v5.007(unsigned)/v5.027(signed) |
| Rockwell Automation | 1756-EN3TR | v5.007(unsigned)/v5.027(signed) |
| Rockwell Automation | 1756-EN2T | 1756-EN2T/D: V10.006 |
| Rockwell Automation | 1756-EN2F | 1756-EN2F/C: V10.009 |
| Rockwell Automation | 1756-EN2TR | 1756-EN2TR/C: V10.007 |
| Rockwell Automation | 1756-EN3TR | 1756-EN3TR/B: V10.007 |
| Rockwell Automation | 1756-EN2TP | 1756-EN2TP/A: V10.020 |
Weakness: CWE-420 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H