CVE-2024-8626
High
Description
Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain web pages of the product causing the affected products to become fully unavailable and require a power cycle to recover.
SeverityHigh
CVSS7.5
Exploit probability—
ProductRockwellautomation Compactlogix 5380 Firmware
PublishedOct 8, 2024
First seenOct 8, 2024
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- rockwellautomation compactlogix_5380_firmware33.015 or later
- rockwellautomation compact_guardlogix_5380_firmware33.015 or later
- rockwellautomation compactlogix_5480_firmware33.015 or later
- rockwellautomation controllogix_5580_firmware33.015 or later
- rockwellautomation guardlogix_5580_firmware33.015 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rockwellautomation compactlogix_5380_firmware | 33.011 ≤ v < 33.015 | 33.015 |
| rockwellautomation compact_guardlogix_5380_firmware | 33.011 ≤ v < 33.015 | 33.015 |
| rockwellautomation compactlogix_5480_firmware | 33.011 ≤ v < 33.015 | 33.015 |
| rockwellautomation controllogix_5580_firmware | 33.011 ≤ v < 33.015 | 33.015 |
| rockwellautomation guardlogix_5580_firmware | 33.011 ≤ v < 33.015 | 33.015 |
| rockwellautomation 1756-en4tr_firmware | 3.002 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.