PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-2424 Rockwell Automation CVE debrief

A high-severity input validation vulnerability in Rockwell Automation's 5015-AENFTXT industrial adapter allows remote attackers to trigger a Major Non-Recoverable Fault (MNRF) via malformed PTP packets, requiring manual device restart to restore availability. The vulnerability was disclosed by CISA on April 11, 2024, with an advisory update on April 25, 2024 expanding affected product versions and mitigations.

Vendor
Rockwell Automation
Product
5015-AENFTXT
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-11
Original CVE updated
2024-04-25
Advisory published
2024-04-11
Advisory updated
2024-04-25

Who should care

Industrial control system operators using Rockwell Automation 5015-AENFTXT adapters in manufacturing, critical infrastructure, and process control environments where device availability is essential for operations.

Technical summary

The vulnerability stems from insufficient input validation when processing PTP (Precision Time Protocol) packets. A malformed PTP packet sent to the secondary adapter triggers a Major Non-Recoverable Fault (MNRF), causing complete device unavailability until manual restart. The attack requires no authentication and can be executed remotely over the network. Affected firmware versions are 2.011 and later versions prior to 2.012.

Defensive priority

HIGH

Recommended defensive actions

  • Update affected 5015-AENFTXT devices to firmware version 2.012 or later per vendor guidance
  • If immediate patching is not feasible, implement network segmentation to restrict PTP traffic to trusted sources only
  • Apply CISA ICS-recommended security best practices for industrial control systems
  • Monitor for unexpected device restarts or MNRF events that may indicate exploitation attempts
  • Review Rockwell Automation security advisory for detection rules and additional mitigation options

Evidence notes

CISA CSAF source identifies affected versions as 5015-AENFTXT firmware >=v2.011 and <v2.012. Attack vector requires network access and malformed PTP (Precision Time Protocol) packets. CVSS 3.1 score of 7.5 reflects high availability impact with no confidentiality or integrity impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-2424 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-2424

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-2424 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-2424

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-102-09.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-102-09

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.