7.3

CVE-2024-6242

A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerRockwell Automation
≫
Produkt ControlLogix® 5580 (1756-L8z)
Default Statusunaffected
Version V28
Status affected
HerstellerRockwell Automation
≫
Produkt GuardLogix® 5580 (1756-L8zS)
Default Statusunaffected
Version V31
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN4TR
Default Statusunaffected
Version V2
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2T
Default Statusunaffected
Version v5.007(unsigned)/v5.027(signed)
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2F
Default Statusunaffected
Version v5.007(unsigned)/v5.027(signed)
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2TR
Default Statusunaffected
Version v5.007(unsigned)/v5.027(signed)
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN3TR
Default Statusunaffected
Version v5.007(unsigned)/v5.027(signed)
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2T
Default Statusunaffected
Version 1756-EN2T/D: V10.006
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2F
Default Statusunaffected
Version 1756-EN2F/C: V10.009
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2TR
Default Statusunaffected
Version 1756-EN2TR/C: V10.007
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN3TR
Default Statusunaffected
Version 1756-EN3TR/B: V10.007
Status affected
HerstellerRockwell Automation
≫
Produkt 1756-EN2TP
Default Statusunaffected
Version 1756-EN2TP/A: V10.020
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.222
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
PSIRT@rockwellautomation.com 7.3 0 0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-420 Unprotected Alternate Channel

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.