CVE-2023-2423 Rockwell Automation Armor PowerFlex Vulnerable to Denial-Of-Service
Attackers can cause a denial-of-service condition in Rockwell Automation Armor PowerFlex devices by flooding network commands, triggering excessive event logging and self-resets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-2423?
CVE-2023-2423 is a high-severity denial of service vulnerability in Rockwell Automation Armor PowerFlex, published on 8 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was discovered in the Rockwell Automation Armor PowerFlex device when the product sends communications to the local event log. Threat actors could exploit this vulnerability by sending an influx of network commands, causing the product to generate an influx of event log traffic at a high rate. If exploited, the product would stop normal operations and self-reset creating a denial-of-service condition. The error code would need to be cleared prior to resuming normal operations.
Weakness: CWE-682
Which versions are affected by CVE-2023-2423?
It affects 1 product.
Products include Rockwellautomation Armor Powerflex Firmware.
How do I fix CVE-2023-2423?
No fix has been published for CVE-2023-2423 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-2423 being exploited?
There is no known exploitation of CVE-2023-2423 in the wild and no public exploit code.
Sources
Also known as GHSA-rq6q-mvj3-3h4x.