title: Rockwell Automation Logix Controllers Uncontrolled Resource Consumption
description: A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online.
problem types: CWE-400: Uncontrolled Resource Consumption
affected:
{
product: CompactLogix 5380 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: 32.013, status: affected, version: unspecified, versionType: custom
}
{
product: Compact GuardLogix 5380 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: 32.013, status: affected, version: unspecified, versionType: custom
}
{
product: CompactLogix 5480 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: 32.013, status: affected, version: unspecified, versionType: custom
}
{
product: ControlLogix 5580 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: 32.013, status: affected, version: unspecified, versionType: custom
}
{
product: GuardLogix 5580 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: 32.013, status: affected, version: unspecified, versionType: custom
}
{
product: CompactLogix 5370 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: 33.013, status: affected, version: unspecified, versionType: custom
}
{
product: Compact GuardLogix 5370 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: 33.013, status: affected, version: unspecified, versionType: custom
}
{
product: ControlLogix 5570 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: 33.013, status: affected, version: unspecified, versionType: custom
}
{
product: GuardLogix 5570 controllers
vendor: Rockwell Automation
versions:
status: affected, version: 33.013
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
]
solutions: Rockwell Automation recommends users update to the latest firmware version to mitigate this vulnerability. Users are directed towards the risk mitigation provided below and are encouraged (where possible) to combine these with the general security guidelines below to employ multiple strategies simultaneously. Users should go to Rockwell Automation's Product Compatibility & Download Center to download the latest firmware.
CompactLogix 5380, Compact GuardLogix 5380, CompactLogix 5480, ControlLogix 5580, GuardLogix 5580: Upgrade to v33.011 firmware
CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, GuardLogix 5570: Upgrade to v34.011 firmware
Please see Rockwell Automation’s security advisory PN1596 for more information.
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135559
workarounds: If upgrading is not possible, Rockwell Automation recommends the following mitigations:
Use of Microsoft AppLocker or other similar allow list applications can help mitigate risk. Information on using AppLocker with products from Rockwell Automation is available in Knowledgebase article QA17329.
Confirm the least-privilege user principle is followed, and user/service account access to shared resources (such as a database) is only granted with a minimum number of rights as needed.
Please see Rockwell Automation’s security advisory PN1596 for more information.
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135559
