Vulnerability · Published Oct 8, 2024 · Assigned by Rockwell
CVE-2024-8626Logix Controllers Vulnerable to Denial-of-Service Vulnerability
High 8.7
In plain English
A high-severity uncontrolled resource consumption in 1756-EN4TR from Rockwell Automation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain web pages of the product causing the affected products to become fully unavailable and require a power cycle to recover.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Rockwell Automation | CompactLogix 5380 controllers | v33.011 < |
| Rockwell Automation | Compact GuardLogix® 5380 controllers | v33.011< |
| Rockwell Automation | CompactLogix 5480 controllers | v33.011< |
| Rockwell Automation | GuardLogix 5580 controllers | v33.011< |
| Rockwell Automation | 1756-EN4TR | v3.002 |
Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N