CVE-2022-3157 Rockwell Automation GuardLogix and ControlLogix controllers Vulnerable to Denial-Of-Service Attack
A malformed CIP request can cause a major non-recoverable fault and denial-of-service in Rockwell Automation PLC controllers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3157?
CVE-2022-3157 is a high-severity denial of service vulnerability in Rockwell Automation Compact GuardLogix, published on 16 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-of-service condition (DOS).
Weakness: CWE-20
Which versions are affected by CVE-2022-3157?
It affects 6 products.
Products include Rockwellautomation Compact Guardlogix 5370 Firmware, Rockwellautomation Compact Guardlogix 5380 Firmware, Rockwellautomation Compactlogix 5370 Firmware, Rockwellautomation Controllogix 5570 Firmware, Rockwellautomation Controllogix 5570 Redundancy Firmware, Rockwellautomation Guardlogix 5570 Firmware.
How do I fix CVE-2022-3157?
No fix has been published for CVE-2022-3157 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-3157 being exploited?
There is no known exploitation of CVE-2022-3157 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Automation Compact GuardLogix
Sources
Also known as GHSA-7cx5-36g6-5r38.