7.3

CVE-2024-6242

Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices

A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRockwell Automation
≫
Produkt ControlLogix® 5580 (1756-L8z)
Default Statusunaffected
Version V28
Status affected
HerstellerRockwell Automation
≫
Produkt GuardLogix® 5580 (1756-L8zS)
Default Statusunaffected
Version V31
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN4TR
Default Statusunaffected
Version V2
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2T
Default Statusunaffected
Version v5.007(unsigned)/v5.027(signed)
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2F
Default Statusunaffected
Version v5.007(unsigned)/v5.027(signed)
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2TR
Default Statusunaffected
Version v5.007(unsigned)/v5.027(signed)
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN3TR
Default Statusunaffected
Version v5.007(unsigned)/v5.027(signed)
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2T
Default Statusunaffected
Version 1756-EN2T/D: V10.006
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2F
Default Statusunaffected
Version 1756-EN2F/C: V10.009
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2TR
Default Statusunaffected
Version 1756-EN2TR/C: V10.007
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN3TR
Default Statusunaffected
Version 1756-EN3TR/B: V10.007
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2TP
Default Statusunaffected
Version 1756-EN2TP/A: V10.020
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.312
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
PSIRT@rockwellautomation.com 7.3 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-420 Unprotected Alternate Channel

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.