What’s Vulnerable › Vulnerabilities

CVE-2022-1797: Rockwell Automation Logix Controllers Uncontrolled Resource Consumption

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-06-02 · updated 2026-06-17
• Weakness: CWE-400

Description

A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online.

Affected products

• Rockwellautomation Compact Guardlogix 5370 Firmware: before 34.011 — fixed in 34.011
• Rockwellautomation Compact Guardlogix 5380 Firmware: before 33.011 — fixed in 33.011
• Rockwellautomation Compactlogix 5370 Firmware: before 34.011 — fixed in 34.011
• Rockwellautomation Compactlogix 5380 Firmware: before 33.011 — fixed in 33.011
• Rockwellautomation Compactlogix 5480 Firmware: before 33.011 — fixed in 33.011
• Rockwellautomation Controllogix 5570 Firmware: before 34.011 — fixed in 34.011
• Rockwell Automation ControlLogix® 5580: before 33.011 — fixed in 33.011
• Rockwellautomation Guardlogix 5570 Firmware: before 34.011 — fixed in 34.011
• Rockwellautomation Guardlogix 5580 Firmware: before 33.011 — fixed in 33.011

How to fix

Upgrade to a fixed version: Rockwellautomation Compact Guardlogix 5370 Firmware 34.011; Rockwellautomation Compact Guardlogix 5380 Firmware 33.011; Rockwellautomation Compactlogix 5370 Firmware 34.011; Rockwellautomation Compactlogix 5380 Firmware 33.011; Rockwellautomation Compactlogix 5480 Firmware 33.011; Rockwellautomation Controllogix 5570 Firmware 34.011; Rockwell Automation ControlLogix® 5580 33.011; Rockwellautomation Guardlogix 5570 Firmware 34.011; Rockwellautomation Guardlogix 5580 Firmware 33.011. Check the vendor advisory for mitigations.

References

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135559
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-144-01
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135559
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-144-01

Get alerted when CVE-2022-1797 or the next vulnerability affects your stack