title: Rockwell Automation CompactLogix 5370 and ControlLogix 5570 Controllers Improper Input Validation
description: The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creating an infinite loop. This may allow an attacker to send specially crafted CIP packet requests to a controller, which may cause denial-of-service conditions in communications with other products.
problem types: CVE-22 Improper Input Validation
affected:
{
product: Armor Compact GuardLogix 5370 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: versions 33 and prior, status: affected, version: unspecified, versionType: custom
}
{
product: Armor GuardLogix Safety Controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: versions 33 and prior, status: affected, version: unspecified, versionType: custom
}
{
product: CompactLogix 5370 L1 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: versions 33 and prior, status: affected, version: unspecified, versionType: custom
}
{
product: CompactLogix 5370 L2 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: versions 33 and prior, status: affected, version: unspecified, versionType: custom
}
{
product: CompactLogix 5370 L3 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: versions 33 and prior, status: affected, version: unspecified, versionType: custom
}
{
product: Compact GuardLogix 5370 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: versions 33 and prior, status: affected, version: unspecified, versionType: custom
}
{
product: ControlLogix 5570 controllers
vendor: Rockwell Automation
versions:
lessThanOrEqual: versions 33 and prior, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
version: 3.1
]
solutions: Rockwell Automation recommends affected users apply firmware v33.011 or later.
For more information see the Rockwell Automation advisory (login required).