Lucene search

IcscertCVE-2017-6024

HistoryMay 06, 2017 - 12:29 a.m.

CVE-2017-6024

2017-05-0600:29:00

CWE-400

icscert

web.nvd.nist.gov

cve-2017-6024

resource exhaustion

rockwell automation

controllogix

compactlogix

nvd

security vulnerability

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011, V28.012, and V28.013; ControlLogix 5580 controllers V29.011; CompactLogix 5380 controllers V28.011; and CompactLogix 5380 controllers V29.011. This vulnerability may allow an attacker to cause a denial of service condition by sending a series of specific CIP-based commands to the controller.

Affected configurations

Nvd

Node

rockwellautomationcompactlogix_5380Match-

AND

rockwellautomationcompactlogix_5380_firmwareMatchv28.011

rockwellautomationcompactlogix_5380_firmwareMatchv29.011

Node

rockwellautomationcontrollogix_5580Match-

AND

rockwellautomationcontrollogix_5580_firmwareMatchv28.011

rockwellautomationcontrollogix_5580_firmwareMatchv28.012

rockwellautomationcontrollogix_5580_firmwareMatchv28.013

rockwellautomationcontrollogix_5580_firmwareMatchv29.011

VendorProductVersionCPE
rockwellautomationcompactlogix_5380-cpe:2.3:h:rockwellautomation:compactlogix_5380:-:*:*:*:*:*:*:*
rockwellautomationcompactlogix_5380_firmwarev28.011cpe:2.3:o:rockwellautomation:compactlogix_5380_firmware:v28.011:*:*:*:*:*:*:*
rockwellautomationcompactlogix_5380_firmwarev29.011cpe:2.3:o:rockwellautomation:compactlogix_5380_firmware:v29.011:*:*:*:*:*:*:*
rockwellautomationcontrollogix_5580-cpe:2.3:h:rockwellautomation:controllogix_5580:-:*:*:*:*:*:*:*
rockwellautomationcontrollogix_5580_firmwarev28.011cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:v28.011:*:*:*:*:*:*:*
rockwellautomationcontrollogix_5580_firmwarev28.012cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:v28.012:*:*:*:*:*:*:*
rockwellautomationcontrollogix_5580_firmwarev28.013cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:v28.013:*:*:*:*:*:*:*
rockwellautomationcontrollogix_5580_firmwarev29.011cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:v29.011:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
rockwellautomation	compactlogix_5380	-	cpe:2.3:h:rockwellautomation:compactlogix_5380:-:::::::*
rockwellautomation	compactlogix_5380_firmware	v28.011	cpe:2.3:o:rockwellautomation:compactlogix_5380_firmware:v28.011:::::::*
rockwellautomation	compactlogix_5380_firmware	v29.011	cpe:2.3:o:rockwellautomation:compactlogix_5380_firmware:v29.011:::::::*
rockwellautomation	controllogix_5580	-	cpe:2.3:h:rockwellautomation:controllogix_5580:-:::::::*
rockwellautomation	controllogix_5580_firmware	v28.011	cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:v28.011:::::::*
rockwellautomation	controllogix_5580_firmware	v28.012	cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:v28.012:::::::*
rockwellautomation	controllogix_5580_firmware	v28.013	cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:v28.013:::::::*
rockwellautomation	controllogix_5580_firmware	v29.011	cpe:2.3:o:rockwellautomation:controllogix_5580_firmware:v29.011:::::::*

CNA Affected

[
  {
    "product": "Rockwell Automation ControlLogix 5580 and CompactLogix 5380",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Rockwell Automation ControlLogix 5580 and CompactLogix 5380"
      }
    ]
  }
]

References

www.securityfocus.com/bid/98309

ics-cert.us-cert.gov/advisories/ICSA-17-094-05

CVSS2

7.1

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:N/I:N/A:C

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

5.7

Confidence

High

EPSS

0.001

Percentile

23.6%

JSON

Related for CVE-2017-6024