CVE-2024-6207

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-14 · updated 2026-06-17
Weakness: CWE-20

Description

CVE 2021-22681 https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.PN1550.html and send a specially crafted CIP message to the device. If exploited, a threat actor could help prevent access to the legitimate user and end connections to connected devices including the workstation. To recover the controllers, a download is required which ends any process that the controller is running.

Affected products

Rockwellautomation Compact Guardlogix 5380 Sil 2 Firmware: from 31.011 before 33.017; from 34.011 before 34.014; from 35.011 before 35.013 — fixed in 33.017, 34.014, 35.013
Rockwellautomation Compact Guardlogix 5380 Sil 3 Firmware: from 32.013 before 33.017; from 34.011 before 34.014; from 35.011 before 35.013 — fixed in 33.017, 34.014, 35.013
Rockwellautomation Compactlogix 5380 Firmware: from 28.011 before 33.017; from 34.011 before 34.014; from 35.011 before 35.013 — fixed in 33.017, 34.014, 35.013
Rockwellautomation Compactlogix 5480 Firmware: from 32.011 before 33.017; from 34.011 before 34.014; from 35.011 before 35.013 — fixed in 33.017, 34.014, 35.013
Rockwell Automation ControlLogix® 5580: from 28.011 before 33.017; from 34.011 before 34.014; from 35.011 before 35.013 — fixed in 33.017, 34.014, 35.013
Rockwellautomation Controllogix 5580 Process Firmware: from 33.011 before 33.017; from 34.011 before 34.014; from 35.011 before 35.013 — fixed in 33.017, 34.014, 35.013
Rockwellautomation Factorytalk Logix Echo Firmware: from 33.011 before 34.014; from 35.011 before 35.013 — fixed in 34.014, 35.013
Rockwellautomation Guardlogix 5580 Firmware: from 31.011 before 33.017; from 34.011 before 34.014; from 35.011 before 35.013 — fixed in 33.017, 34.014, 35.013

How to fix

Upgrade to a fixed version: Rockwellautomation Compact Guardlogix 5380 Sil 2 Firmware 33.017, 34.014, 35.013; Rockwellautomation Compact Guardlogix 5380 Sil 3 Firmware 33.017, 34.014, 35.013; Rockwellautomation Compactlogix 5380 Firmware 33.017, 34.014, 35.013; Rockwellautomation Compactlogix 5480 Firmware 33.017, 34.014, 35.013; Rockwell Automation ControlLogix® 5580 33.017, 34.014, 35.013; Rockwellautomation Controllogix 5580 Process Firmware 33.017, 34.014, 35.013; Rockwellautomation Factorytalk Logix Echo Firmware 34.014, 35.013; Rockwellautomation Guardlogix 5580 Firmware 33.017, 34.014, 35.013. Check the vendor advisory for mitigations.

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1707.html

Get alerted when CVE-2024-6207 or the next vulnerability affects your stack