PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-6077 Rockwell Automation CVE debrief

A denial-of-service vulnerability exists in Rockwell Automation ControlLogix/GuardLogix 5580 and CompactLogix/Compact GuardLogix 5380 controllers when specially crafted packets are sent to the CIP security object. Successful exploitation renders the device unavailable and requires a factory reset to recover. The vulnerability was disclosed on September 12, 2024, with a CVSS 3.1 score of 7.5 (HIGH). Rockwell Automation has released corrected firmware versions for all affected products.

Vendor
Rockwell Automation
Product
CompactLogix 5380
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-09-12
Original CVE updated
2024-09-12
Advisory published
2024-09-12
Advisory updated
2024-09-12

Who should care

Industrial control system operators, OT security teams, manufacturing engineers, and asset owners using Rockwell Automation ControlLogix, GuardLogix, or CompactLogix controllers with CIP Security enabled. Organizations in critical infrastructure sectors including manufacturing, energy, water, and chemical processing should prioritize assessment due to the high availability impact and recovery complexity.

Technical summary

CVE-2024-6077 is a network-accessible denial-of-service vulnerability in Rockwell Automation industrial controllers. The flaw exists in the CIP security object implementation across multiple controller families. An unauthenticated attacker can send specially crafted packets to trigger the vulnerability, causing immediate device unavailability. Recovery requires physical intervention and factory reset, resulting in significant operational downtime for affected industrial control systems. The vulnerability affects nine product variants including CompactLogix 5380/5480, ControlLogix 5580, GuardLogix 5580, and 1756-EN4 communication modules. Rockwell Automation has released corrected firmware versions (v33.017 and later series) to address the issue.

Defensive priority

high

Recommended defensive actions

  • Upgrade affected CompactLogix 5380 controllers to firmware v33.017, v34.014, v35.013, v36.011 or later
  • Upgrade affected CompactLogix 5380 Process controllers to firmware v33.017, v34.014, v35.013, v36.011 or later
  • Upgrade affected Compact GuardLogix 5380 SIL 2 controllers to firmware v33.017, v34.014, v35.013, v36.011 or later
  • Upgrade affected Compact GuardLogix 5380 SIL 3 controllers to firmware v33.017, v34.014, v35.013, v36.011 or later
  • Upgrade affected CompactLogix 5480 controllers to firmware v33.017, v34.014, v35.013, v36.011 or later
  • Upgrade affected ControlLogix 5580 controllers to firmware v33.017, v34.014, v35.013, v36.011 or later
  • Upgrade affected ControlLogix 5580 Process controllers to firmware v33.017, v34.014, v35.013, v36.011 or later
  • Upgrade affected GuardLogix 5580 controllers to firmware v33.017, v34.014, v35.013, v36.011 or later

Evidence notes

CISA ICS Advisory ICSA-24-256-18 documents this vulnerability in Rockwell Automation controllers. The advisory confirms nine affected product variants across CompactLogix 5380, CompactLogix 5480, ControlLogix 5580, GuardLogix 5580, and 1756-EN4 communication modules. The vulnerability is triggered via the CIP security object and results in complete device unavailability requiring factory reset.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-6077 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-6077

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-6077 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-6077

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-256-18.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-18

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.