← Back

CVE-2024-8626

nvd nist
Published: Oct 8, 2024Modified: Feb 27, 2025

JSON object

Loading...
8.7
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: PSIRT@rockwellautomation.com (Secondary)

Description

Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain web pages of the product causing the affected products to become fully unavailable and require a power cycle to recover.

Affected (6)

Rockwellautomation
6 products
Compactlogix 5380 Firmware
Compact Guardlogix 5380 Firmware
Compactlogix 5480 Firmware
Controllogix 5580 Firmware
Guardlogix 5580 Firmware
1756 En4tr Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Compactlogix 5380 Firmware
From 33.011 to 33.015
Running on/withPlatform Versions
Rockwellautomation
Compactlogix 5380
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Compact Guardlogix 5380 Firmware
From 33.011 to 33.015
Running on/withPlatform Versions
Rockwellautomation
Compact Guardlogix 5380
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Compactlogix 5480 Firmware
From 33.011 to 33.015
Running on/withPlatform Versions
Rockwellautomation
Compactlogix 5480
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Controllogix 5580 Firmware
From 33.011 to 33.015
Running on/withPlatform Versions
Rockwellautomation
Controllogix 5580
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Guardlogix 5580 Firmware
From 33.011 to 33.015
Running on/withPlatform Versions
Rockwellautomation
Guardlogix 5580
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
1756 En4tr Firmware
Version 3.002
Running on/withPlatform Versions
Rockwellautomation
1756 En4tr
All versions

Related CWEs

CWE-400
Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CWE-401
Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (1)

Source: PSIRT@rockwellautomation.com
Vendor Advisory

Timeline

No history available yet.