CVE-2024-6436 Rockwell Automation Input Validation Vulnerability exists in the SequenceManager™ Server
A malicious user can send malformed packets to the SequenceManager Server, causing a denial-of-service condition that requires a manual restart.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6436?
CVE-2024-6436 is a high-severity denial of service vulnerability in Rockwell Automation SequenceManager™, published on 27 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An input validation vulnerability exists in the Rockwell Automation Sequence Manager™ which could allow a malicious user to send malformed packets to the server and cause a denial-of-service condition. If exploited, the device would become unresponsive, and a manual restart will be required for recovery. Additionally, if exploited, there could be a loss of view for the downstream equipment sequences in the controller. Users would not be able to view the status or command the equipment sequences, however the equipment sequence would continue to execute uninterrupted.
Weakness: CWE-20
Which versions are affected by CVE-2024-6436?
It affects 1 product.
Products include Rockwellautomation Sequencemanager.
How do I fix CVE-2024-6436?
No fix has been published for CVE-2024-6436 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-6436 being exploited?
There is no known exploitation of CVE-2024-6436 in the wild and no public exploit code.
Sources
Also known as GHSA-g2f6-cxmc-24cj.