CVE-2024-3493 Rockwell Automation ControlLogix and GaurdLogix Vulnerable to Major Nonrecoverable Fault Due to Invalid Header Value
A malformed fragmented packet causes a major nonrecoverable fault in Rockwell PLCs, requiring manual restart and potentially losing control of connected devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-3493?
CVE-2024-3493 is a high-severity denial of service vulnerability in Rockwell Automation 1756-EN4TR, published on 15 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send large amounts of data) can cause a major nonrecoverable fault (MNRF) Rockwell Automation's ControlLogix 5580, Guard Logix 5580, CompactLogix 5380, and 1756-EN4TR. If exploited, the affected product will become unavailable and require a manual restart to recover it. Additionally, an MNRF could result in a loss of view and/or control of connected devices.
Weakness: CWE-20
Which versions are affected by CVE-2024-3493?
It affects 8 products.
Products include Rockwellautomation 1756-En4tr Firmware, Rockwellautomation Compact Guardlogix 5380 Firmware, Rockwellautomation Compactlogix 5380 Firmware, Rockwellautomation Compactlogix 5380 Process Firmware, Rockwellautomation Compactlogix 5480 Firmware, Rockwellautomation Controllogix 5580 Firmware and 2 more.
How do I fix CVE-2024-3493?
No fix has been published for CVE-2024-3493 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-3493 being exploited?
There is no known exploitation of CVE-2024-3493 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Automation 1756-EN4TR
Sources
Also known as GHSA-mjg4-p237-8j88.