CVE-2024-5659 Rockwell Automation Multicast Request Causes major nonrecoverable fault on Select Controllers
Attackers can cause major nonrecoverable faults on Rockwell controllers by sending abnormal packets to the mDNS port, compromising device availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-5659?
CVE-2024-5659 is a high-severity denial of service vulnerability in Rockwell Automation 1756-EN4, published on 14 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Rockwell Automation was made aware of a vulnerability that causes all affected controllers on the same network to result in a major nonrecoverable fault(MNRF/Assert). This vulnerability could be exploited by sending abnormal packets to the mDNS port. If exploited, the availability of the device would be compromised.
Weakness: CWE-670
Which versions are affected by CVE-2024-5659?
It affects 6 products.
Products include Rockwellautomation 1756-En4 Firmware, Rockwellautomation Compact Guardlogix 5380 Firmware, Rockwellautomation Compactlogix 5380 Firmware, Rockwellautomation Compactlogix 5480 Firmware, Rockwellautomation Controllogix 5580 Firmware, Rockwellautomation Guardlogix 5580 Firmware.
How do I fix CVE-2024-5659?
No fix has been published for CVE-2024-5659 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-5659 being exploited?
There is no known exploitation of CVE-2024-5659 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Automation 1756-EN4
Sources
Also known as GHSA-949p-hqw3-rgm2.