mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-07-30 18:04:30 +00:00
134 lines
7.7 KiB
JSON
134 lines
7.7 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2024-3493",
|
|
"ASSIGNER": "PSIRT@rockwellautomation.com",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "\nA specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send large amounts of data) can cause a major nonrecoverable fault (MNRF) Rockwell Automation's ControlLogix 5580, Guard Logix\u00a05580,\u00a0CompactLogix 5380,\u00a0and 1756-EN4TR. If exploited, the affected product will become unavailable and require a manual restart to recover it. Additionally, an MNRF could result in a loss of view and/or control of connected devices. \n\n"
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "CWE-20 Improper Input Validation",
|
|
"cweId": "CWE-20"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "Rockwell Automation",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "ControlLogix 5580",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "v35.011"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "GuardLogix 5580",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "v35.011"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "CompactLogix 5380",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "v5.001"
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"product_name": "1756-EN4TR",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "=",
|
|
"version_value": "v5.001"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://www.rockwellautomation.com/en-us/support/advisory.SD1666.html",
|
|
"refsource": "MISC",
|
|
"name": "https://www.rockwellautomation.com/en-us/support/advisory.SD1666.html"
|
|
}
|
|
]
|
|
},
|
|
"generator": {
|
|
"engine": "Vulnogram 0.1.0-dev"
|
|
},
|
|
"source": {
|
|
"discovery": "INTERNAL"
|
|
},
|
|
"solution": [
|
|
{
|
|
"lang": "en",
|
|
"supportingMedia": [
|
|
{
|
|
"base64": false,
|
|
"type": "text/html",
|
|
"value": "\n\n<p>\n\n</p><table><tbody><tr><td><p><br>Affected Product</p><p> </p><p> </p></td><td><p> </p><p> </p><p>First Known in Firmware Revision</p><p> </p><p> </p></td><td><p> </p><p> </p><p>Corrected in Firmware Revision</p><p> </p><p> </p></td></tr><tr><td><p> </p><p> </p><p>ControlLogix\u00ae 5580</p><p> </p><p> </p></td><td><p> </p><p> </p><p>V35.011</p><p> </p><p> </p></td><td><p> </p><p> </p><p>V35.013, V36.011</p><p> </p><p> </p></td></tr><tr><td><p> </p><p> </p><p>GuardLogix 5580</p><p> </p><p> </p></td><td><p> </p><p> </p><p>V35.011</p><p> </p><p> </p></td><td><p> </p><p> </p><p>V35.013, V36.011</p><p> </p><p> </p></td></tr><tr><td><p> </p><p> </p><p>CompactLogix 5380</p><p> </p><p> </p></td><td><p> </p><p> </p><p>V35.011</p><p> </p><p> </p></td><td><p> </p><p> </p><p>V35.013, V36.011</p><p> </p><p> </p></td></tr><tr><td><p> </p><p> </p><p>1756-EN4TR</p><p> </p><p> </p></td><td><p> </p><p> </p><p>V5.001</p><p> </p><p> </p></td><td><p> </p><p> </p><p>V6.001</p><p> </p><p> </p></td></tr></tbody></table>\n\n<br><br><p></p><p>Users using the affected software and who are not able to upgrade to one of the corrected versions are encouraged to apply security best practices, where possible.\u202f\u202f</p><ul><li><p><a target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight\">Security Best Practices</a> </p></li></ul>\n\n<br>"
|
|
}
|
|
],
|
|
"value": "\nAffected Product\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nFirst Known in Firmware Revision\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nCorrected in Firmware Revision\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nControlLogix\u00ae 5580\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nV35.011\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nV35.013, V36.011\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nGuardLogix 5580\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nV35.011\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nV35.013, V36.011\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nCompactLogix 5380\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nV35.011\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nV35.013, V36.011\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n1756-EN4TR\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nV5.001\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\n\u00a0\n\nV6.001\n\n\u00a0\n\n\u00a0\n\nUsers using the affected software and who are not able to upgrade to one of the corrected versions are encouraged to apply security best practices, where possible.\u202f\u202f\n\n * Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight \u00a0\n\n"
|
|
}
|
|
],
|
|
"impact": {
|
|
"cvss": [
|
|
{
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "HIGH",
|
|
"baseScore": 8.6,
|
|
"baseSeverity": "HIGH",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "NONE",
|
|
"privilegesRequired": "NONE",
|
|
"scope": "CHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
|
|
"version": "3.1"
|
|
}
|
|
]
|
|
}
|
|
} |