PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-7515 Rockwell Automation CVE debrief

A denial-of-service vulnerability in Rockwell Automation industrial controllers allows unauthenticated remote attackers to trigger a major nonrecoverable fault by sending a malformed Precision Time Protocol (PTP) management packet. The vulnerability affects five product lines across the ControlLogix, GuardLogix, CompactLogix, and Compact GuardLogix families. Successful exploitation causes complete controller failure requiring manual intervention to restore operations. The CVSS 3.1 score of 8.6 reflects high availability impact with network attack vector, low attack complexity, and no required privileges or user interaction. The vulnerability was disclosed on August 13, 2024 via CISA ICS advisory ICSA-24-226-10.

Vendor
Rockwell Automation
Product
CompactLogix 5380 (5069 - L3z)
CVSS
HIGH 8.6
CISA KEV
Not listed in stored evidence
Original CVE published
2024-08-13
Original CVE updated
2024-08-13
Advisory published
2024-08-13
Advisory updated
2024-08-13

Who should care

Organizations operating Rockwell Automation ControlLogix 5580, GuardLogix 5580, CompactLogix 5380/5480, or Compact GuardLogix 5380 controllers in manufacturing, critical infrastructure, or industrial automation environments. OT security teams, plant engineers, and asset owners relying on these controllers for process control should prioritize firmware updates and network access restrictions.

Technical summary

The vulnerability exists in the PTP (Precision Time Protocol) management packet handling of affected Rockwell Automation controllers. A malformed PTP management packet sent to the controller causes a major nonrecoverable fault (MNRF), resulting in complete operational failure. The attack requires network access to the controller but no authentication. Affected products include CompactLogix 5380 (5069-L3z), CompactLogix 5480 (5069-L4), ControlLogix 5580 (1756-L8z), GuardLogix 5580 (1756-L8z), and Compact GuardLogix 5380 (5069-L3zS2) running firmware versions prior to v36.011, v35.013, or v34.014 depending on the major release branch. The vulnerability is particularly concerning in industrial environments where controller availability is critical and PTP is used for time synchronization across control systems.

Defensive priority

HIGH

Recommended defensive actions

  • Update affected controllers to firmware version v36.011, v35.013, v34.014 or later as specified for each product line
  • Restrict network communication to CIP object 103 (0x67) to limit attack surface
  • Implement network segmentation to isolate industrial control systems from untrusted networks
  • Apply Rockwell Automation security best practices for industrial automation control systems
  • Monitor for unexpected controller faults or PTP management traffic on affected networks

Evidence notes

Vulnerability description and affected products confirmed via CISA CSAF advisory ICSA-24-226-10. CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H sourced from advisory references. Remediation guidance including specific firmware versions and CIP object restriction sourced from CSAF remediations section.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-7515 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-7515

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-7515 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-7515

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-226-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.