PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-40619 Rockwell Automation CVE debrief

A denial-of-service vulnerability in Rockwell Automation GuardLogix 5580 and ControlLogix 5580 industrial controllers can be triggered by sending a malformed Common Industrial Protocol (CIP) packet over the network, resulting in a major nonrecoverable fault. The vulnerability, published on August 13, 2024, carries a CVSS 3.1 score of 7.5 (HIGH severity) due to its network attack vector, low attack complexity, and no required privileges or user interaction. Affected products include ControlLogix 5580 and GuardLogix 5580 controllers running firmware version 34.011 and later. Rockwell Automation has released firmware updates to address this issue.

Vendor
Rockwell Automation
Product
ControlLogix 5580
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-08-13
Original CVE updated
2024-08-13
Advisory published
2024-08-13
Advisory updated
2024-08-13

Who should care

Organizations operating Rockwell Automation ControlLogix 5580 or GuardLogix 5580 controllers in industrial environments, particularly those with CIP-enabled devices exposed to operational technology networks or with remote access capabilities. Critical infrastructure operators in manufacturing, energy, water, and process industries should prioritize assessment and patching.

Technical summary

The vulnerability exists in the CIP protocol implementation of affected Rockwell Automation controllers. When a malformed CIP packet is received over the network, the device experiences a major nonrecoverable fault (MNRF), causing a denial-of-service condition. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) indicates the attack is network-exploitable with low complexity, requiring no privileges or user interaction, with high impact to availability. Firmware version 34.014 and later contain the remediation.

Defensive priority

high

Recommended defensive actions

  • Apply vendor firmware updates: Update ControlLogix 5580 and GuardLogix 5580 controllers to version 34.014 or later.
  • Implement network segmentation for industrial control systems to limit exposure of CIP-enabled devices to untrusted networks.
  • Deploy deep packet inspection or industrial protocol-aware firewalls to filter malformed CIP traffic at network boundaries.
  • Follow Rockwell Automation security best practices for industrial automation control systems.
  • Use CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) framework to prioritize remediation based on environmental risk factors.

Evidence notes

Vulnerability details sourced from CISA CSAF advisory ICSA-24-226-03. CVSS vector confirms network-based attack with no authentication required. Affected product versions explicitly listed in CSAF product tree.

Official resources

2024-08-13