Vulnerability · Published Apr 15, 2024 · Assigned by Rockwell

CVE-2024-2424Rockwell Automation Input/Output Device Vulnerable to Major Nonrecoverable Fault

High 7.5

In plain English

A high-severity improper input validation in 5015-AENFTXT from Rockwell Automation . There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 85% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)2.6%top 14.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to result in a major nonrecoverable fault (MNRF) when malicious input is entered. If exploited, the availability of the device will be impacted, and a manual restart is required. Additionally, a malformed PTP packet is needed to exploit this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
Rockwell Automation	5015-AENFTXT	v35

Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://www.rockwellautomation.com/en-us/support/advisory.SD1667.html