CVE-2024-6077

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A denial-of-service vulnerability exists in the Rockwell Automation affected products when specially crafted packets are sent to the CIP Security Object. If exploited the device will become unavailable and require a factory reset to recover.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Rockwell Automation	CompactLogix 5380	v.32 .011
Rockwell Automation	CompactLogix 5380 Process	v.33.011
Rockwell Automation	Compact GuardLogix 5380 SIL 2	v.32.013
Rockwell Automation	Compact GuardLogix 5380 SIL 3	v.32.011
Rockwell Automation	CompactLogix 5480	v.32.011
Rockwell Automation	ControlLogix® 5580	v.32.011
Rockwell Automation	ControlLogix® 5580 Process	v.33.011
Rockwell Automation	GuardLogix 5580	v.32.011
Rockwell Automation	1756-EN4	v2.001
rockwellautomation	compactlogix_5480_firmware	>= 32 .011, < 33.017; >= 34.0, < 34.014; >= 35.0, < 35.013; >= 36.0, < 36.011
rockwellautomation	compactlogix_5380_process_firmware	>= 33.011, < 33.017; >= 34.0, < 34.014; >= 35.0, < 35.013; >= 36.0, < 36.011
rockwellautomation	compact_guardlogix_5380_sil2_firmware	>= 32.013, < 33.017; >= 34.0, < 34.014; >= 35.0, < 35.013; >= 36.0, < 36.011
rockwellautomation	1756-en4_firmware	>= 2.001, < 6.001

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1963.htmlVendor Advisory

Timeline

Published: Sep 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-60788.6CVE-2024-6078 IMPACT An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generat CVE-2024-60795.4A vulnerability exists in the Rockwell Automation Emulate3D™, which could be leveraged to execute a DLL Hijacking attack. The application lo CVE-2024-60807.8A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component in CVE-2024-60826.1A vulnerability, which was classified as problematic, has been found in PHPVibe 11.0.46. This issue affects some unknown processing of the f CVE-2024-60839.8A vulnerability, which was classified as critical, was found in PHPVibe 11.0.46. Affected is an unknown function of the file /app/uploading/CVE-2024-60849.8A vulnerability has been found in itsourcecode Pool of Bethesda Online Reservation System up to 1.0 and classified as critical. Affected by CVE-2024-60858.6A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ab CVE-2024-60864.3In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organization due to improp CVE-2024-60876.5An improper access control vulnerability exists in lunary-ai/lunary at the latest commit (a761d83) on the main branch. The vulnerability all CVE-2024-60885.3The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check CVE-2024-60897.5An input validation vulnerability exists in the Rockwell Automation 5015 - AENFTXT when a manipulated PTP packet is sent, causing the second CVE-2024-60907.5A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other users' chat historie