CVE-2024-3493

highPriorität · verfolgen · 30EPSS 0.006 · 50. PerzentilDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.64% (50th) EPSS
CVSS 7.5 · high
Is it mine?
38 products
Prüfe deine Angriffsfläche
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-23

A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send large amounts of data) can cause a major nonrecoverable fault (MNRF) Rockwell Automation's ControlLogix 5580, Guard Logix 5580, CompactLogix 5380, and 1756-EN4TR. If exploited, the affected product will become unavailable and require a manual restart to recover it. Additionally, an MNRF could result in a loss of view and/or control of connected devices.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • Behoben1756-EN4TRcisa_csaf_ot

    1756-EN4TR: Update to version V6.001

  • BehobenCompact GuardLogix 5380cisa_csaf_ot

    Compact GuardLogix 5380: Update to version V35.013, V36.011 and later

  • BehobenCompactLogix 5380cisa_csaf_ot

    CompactLogix 5380 Process: Update to version V35.013, V36.011 and later

  • BehobenCompactLogix 5380 Processcisa_csaf_ot

    CompactLogix 5380 Process: Update to version V35.013, V36.011 and later

  • BehobenCompactLogix 5480cisa_csaf_ot

    CompactLogix 5480: Update to version V35.013, V36.011 and later

  • BehobenControlLogix 5580cisa_csaf_ot

    ControlLogix 5580 Process: Update to version V35.013, V36.011 and later

  • BehobenControlLogix 5580 Processcisa_csaf_ot

    ControlLogix 5580 Process: Update to version V35.013, V36.011 and later

  • BehobenGuardLogix 5580cisa_csaf_ot

    GuardLogix 5580: Update to version V35.013 or V36.011

  • Mitigation1756-EN4TRcisa_csaf_ot

    Rockwell Automation has released product updates addressing this vulnerability:

  • MitigationCompact GuardLogix 5380cisa_csaf_ot

    Rockwell Automation has released product updates addressing this vulnerability:

  • MitigationCompactLogix 5380cisa_csaf_ot

    Rockwell Automation has released product updates addressing this vulnerability:

  • MitigationCompactLogix 5380 Processcisa_csaf_ot

    Rockwell Automation has released product updates addressing this vulnerability:

  • MitigationCompactLogix 5480cisa_csaf_ot

    Rockwell Automation has released product updates addressing this vulnerability:

  • MitigationControlLogix 5580cisa_csaf_ot

    Rockwell Automation has released product updates addressing this vulnerability:

  • MitigationControlLogix 5580 Processcisa_csaf_ot

    Rockwell Automation has released product updates addressing this vulnerability:

  • MitigationGuardLogix 5580cisa_csaf_ot

    Rockwell Automation has released product updates addressing this vulnerability:

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.6
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–8.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · CISA US
v3.18.6highAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · ENISA EU
v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · PSIRT@rockwellautomation.comAusnutzbarkeit 3.9 · Auswirkung 4
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USCWE-20USCWE-20US
05

betroffene Produkte (38)

Betroffene Produkte und Versionsbereiche.

20 von 38 angezeigt
06

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • WID-SEC-W-2024-0908Rockwell Automation ControlLogix: Schwachstelle ermöglicht Denial of ServiceDeutsch2024-04-16csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Rockwell Automation ControlLogix ausnutzen, um einen Denial of Service Angriff durchzuführen.

  • ICSA-24-107-03Rockwell Automation ControlLogix and GuardLogix (Update A)2024-04-16icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow an attacker to cause a major nonrecoverable fault (MNRF) resulting in the product to become unavailable.

07

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otcert_bundNVDCVE.orgMITRE
veröffentlicht 2024-04-15geändert 2026-06-17
09

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan