What’s Vulnerable › Vulnerabilities
CVE-2024-7507: Rockwell Automation ControlLogix/GuardLogix 5580 and CompactLogix/Compact GuardLogix® 5380 Controller Denial-of-Service Vulnerability via Input Validation
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-08-14 · updated 2026-06-17
- Weakness: CWE-20
Description
CVE-2024-7507 IMPACT A denial-of-service vulnerability exists in the affected products. This vulnerability occurs when a malformed PCCC message is received, causing a fault in the controller.
Affected products
- Rockwellautomation Compact Guardlogix 5380 Sil 2 Firmware: from 31.011 before 34.014; 35.011 — fixed in 34.014
- Rockwellautomation Compact Guardlogix 5380 Sil 3 Firmware: from 32.013 before 34.014; 35.011 — fixed in 34.014
- Rockwellautomation Compactlogix 5380 Firmware: from 28.011 before 34.014; 35.011 — fixed in 34.014
- Rockwellautomation Compactlogix 5480 Firmware: from 32.011 before 34.014; 35.011 — fixed in 34.014
- Rockwell Automation ControlLogix® 5580: from 28.011 before 34.014; 35.011 — fixed in 34.014
- Rockwellautomation Guardlogix 5580 Firmware: from 31.011 before 34.014; 35.011 — fixed in 34.014
How to fix
Upgrade to a fixed version: Rockwellautomation Compact Guardlogix 5380 Sil 2 Firmware 34.014; Rockwellautomation Compact Guardlogix 5380 Sil 3 Firmware 34.014; Rockwellautomation Compactlogix 5380 Firmware 34.014; Rockwellautomation Compactlogix 5480 Firmware 34.014; Rockwell Automation ControlLogix® 5580 34.014; Rockwellautomation Guardlogix 5580 Firmware 34.014. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-7507 or the next vulnerability affects your stack