Rockwell Automation Logix Controllers Uncontrolled Resource Consumption
CVE-2022-1797

6.8MEDIUM

Key Information:

Vendor
Rockwell Automation
Status
Compactlogix 5380 Controllers
Compact Guardlogix 5380 Controllers
Compactlogix 5480 Controllers
Controllogix 5580 Controllers
Vendor
CVE Published:
2 June 2022

Summary

A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online.

Affected Version(s)

Compact GuardLogix 5370 controllers <= 33.013

Compact GuardLogix 5380 controllers <= 32.013

CompactLogix 5370 controllers <= 33.013

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-144-01
x_refsource_CONFIRM
https://rockwellautomation.custhelp.com/app/answers/answe...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rockwell Automation discovered this vulnerability during routine security testing and reported it to CISA.
.