CVE-2024-40619 Denial of service in ControlLogix® 5580
Attackers can cause a denial-of-service in Rockwell Automation controllers by sending malformed CIP packets, requiring immediate patching for industrial safety.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-40619?
CVE-2024-40619 is a high-severity denial of service vulnerability in Rockwell Automation ControlLogix® 5580, published on 14 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CVE-2024-40619 IMPACT
A denial-of-service vulnerability exists in the affected products. The vulnerability occurs when a malformed CIP packet is sent over the network to the device and results in a major nonrecoverable fault causing a denial-of-service.
Weakness: CWE-754
Which versions are affected by CVE-2024-40619?
It affects 2 products.
Products include Rockwellautomation Controllogix 5580 Firmware, Rockwellautomation Guardlogix 5580 Firmware.
How do I fix CVE-2024-40619?
No fix has been published for CVE-2024-40619 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-40619 being exploited?
There is no known exploitation of CVE-2024-40619 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Automation ControlLogix® 5580
Sources
Also known as GHSA-89fm-3w27-7c7q.