CVE-2024-21916 Rockwell Automation Denial-of-service Vulnerability in ICE1 Controller
Attackers can cause a major nonrecoverable fault in Rockwell ControlLogix and GuardLogix controllers, forcing a device restart.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-21916?
CVE-2024-21916 is a high-severity denial of service vulnerability in Rockwell Automation ControlLogix® 5570, published on 31 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial-of-service vulnerability exists in specific Rockwell Automation ControlLogix ang GuardLogix controllers. If exploited, the product could potentially experience a major nonrecoverable fault (MNRF). The device will restart itself to recover from the MNRF.
Weakness: CWE-119
Which versions are affected by CVE-2024-21916?
It affects 3 products.
Products include Rockwellautomation Controllogix 5570 Controller Firmware, Rockwellautomation Controllogix 5570 Redundant Controller Firmware, Rockwellautomation Guardlogix 5570 Controller Firmware.
How do I fix CVE-2024-21916?
No fix has been published for CVE-2024-21916 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-21916 being exploited?
There is no known exploitation of CVE-2024-21916 in the wild and no public exploit code.
Sources
Also known as GHSA-2798-r58g-fffv.