CVE-2024-8626: Logix Controllers Vulnerable to Denial-of-Service Vulnerability
First published: Tue Oct 08 2024(Updated: )
Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain web pages of the product causing the affected products to become fully unavailable and require a power cycle to recover.
Credit: PSIRT@rockwellautomation.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rockwell Automation Logix Controllers | ||
| All of | ||
| Rockwell Automation CompactLogix 5380 Firmware | >=33.011<33.015 | |
| Rockwell Automation CompactLogix 5380 Firmware | ||
| All of | ||
| Rockwell Automation Compact GuardLogix 5380 SIL 3 Firmware | >=33.011<33.015 | |
| Rockwell Automation Compact GuardLogix 5380 Firmware | ||
| All of | ||
| Rockwell Automation CompactLogix 5480 Firmware | >=33.011<33.015 | |
| Rockwell Automation CompactLogix 5480 | ||
| All of | ||
| Rockwell Automation ControlLogix 5580 Firmware | >=33.011<33.015 | |
| Rockwell Automation ControlLogix 5580 Firmware | ||
| All of | ||
| Rockwell Automation GuardLogix 5580 Firmware | >=33.011<33.015 | |
| Rockwell Automation GuardLogix 5580 | ||
| All of | ||
| Rockwell Automation 1756-EN4TR | =3.002 | |
| Rockwell Automation 1756-EN4TR |
Remedy
Affected Product First Known in firmware Revision Corrected in Firmware Revision CompactLogix 5380 controllers v33.011 < * v33.015 and later for versions 33 * v34.011 and later Compact GuardLogix® 5380 controllers v33.011< CompactLogix 5480 controllers v33.011< ControlLogix 5580 controllers v33.011< GuardLogix 5580 controllers v33.011< 1756-EN4TR v3.002 * 4.001 and later Mitigations and Workarounds Customers using the affected versions are encouraged to upgrade to corrected firmware versions. We also strongly encourage customers to implement our suggested security best practices to minimize the risk of the vulnerability. * Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-8626?
CVE-2024-8626 is classified as a denial-of-service vulnerability due to a memory leak in Rockwell Automation products.
How do I fix CVE-2024-8626?
To mitigate CVE-2024-8626, it's recommended to apply any available patches provided by Rockwell Automation for the affected products.
What products are affected by CVE-2024-8626?
CVE-2024-8626 affects Rockwell Automation Logix Controllers.
Can CVE-2024-8626 be exploited remotely?
Yes, CVE-2024-8626 can be exploited remotely by a malicious actor through specific actions on certain web pages of the affected products.
What could happen if CVE-2024-8626 is exploited?
Exploitation of CVE-2024-8626 could lead to the affected Rockwell Automation products becoming fully unavailable.
- agent/references
- agent/remedy
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/event
- collector/nvd-api
- source/NVD
- vendor/rockwell automation
- canonical/rockwell automation logix controllers
- vendor/rockwellautomation
- canonical/rockwell automation compactlogix 5380 firmware
- version/rockwell automation compactlogix 5380 firmware/33.011
- canonical/rockwell automation compact guardlogix 5380 sil 3 firmware
- version/rockwell automation compact guardlogix 5380 sil 3 firmware/33.011
- canonical/rockwell automation compact guardlogix 5380 firmware
- canonical/rockwell automation compactlogix 5480 firmware
- version/rockwell automation compactlogix 5480 firmware/33.011
- canonical/rockwell automation compactlogix 5480
- canonical/rockwell automation controllogix 5580 firmware
- version/rockwell automation controllogix 5580 firmware/33.011
- canonical/rockwell automation guardlogix 5580 firmware
- version/rockwell automation guardlogix 5580 firmware/33.011
- canonical/rockwell automation guardlogix 5580
- canonical/rockwell automation 1756-en4tr
- version/rockwell automation 1756-en4tr/3.002