CVE-2024-6207
Improper Input Validation (CWE-20)
Published: Oct 14, 2024 / Updated: 36d ago

010

CVSS 8.7EPSS 0.04%High

CVE info copied to clipboard

Summary

A vulnerability exists in certain Rockwell Automation products, including ControlLogix 5580, GuardLogix, and CompactLogix controllers. This vulnerability allows an attacker to send a specially crafted CIP message to the affected device.

Impact

If exploited, this vulnerability could allow a threat actor to prevent access to legitimate users and end connections to connected devices, including workstations. This could result in a denial of service condition. The impact on availability is high, while there are no direct impacts on confidentiality or integrity.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

Information about a specific patch is not provided in the given data. However, to recover the controllers after an attack, a download is required, which ends any process that the controller is running.

Mitigation

Specific mitigation strategies are not provided in the given data. However, general best practices for industrial control systems should be followed, such as network segmentation, limiting network exposure of control devices, and implementing strong access controls. Additionally, monitoring for unusual CIP messages or unexpected disconnections could help detect potential exploitation attempts.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

First Article

Feedly found the first article mentioning CVE-2024-6207. See article

Oct 10, 2024 at 6:04 PM / CISA

Threat Intelligence Report

CVE-2024-6207 is a vulnerability with a CVSS v3.1 base score of 7.5 and a CVSS v4 base score of 8.7, indicating a significant level of criticality. The details provided do not specify whether it is being exploited in the wild, nor do they mention any proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on third-party vendors or technology. Further investigation would be necessary to assess the full scope and implications of this vulnerability. See article

Oct 10, 2024 at 6:04 PM

CVE Assignment

NVD published the first details for CVE-2024-6207

Oct 14, 2024 at 9:15 PM

CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Oct 15, 2024 at 5:23 AM

EPSS

EPSS Score was set to: 0.04% (Percentile: 9.7%)

Oct 15, 2024 at 10:16 AM