ControlLogix® 5580 (1756-L8z): Unprotected Alternate Channel
CVE-2024-6242 is a high-severity unprotected alternate channel vulnerability in ControlLogix® 5580 (1756-L8z) from Rockwell Automation, with a CVSS 4.0 base score of 7.3 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected ControlLogix® 5580 (1756-L8z) versions: V28. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 11.1% chance of exploitation within 30 days, which is in the top 4% of all scored CVEs.
EPSS places it among the vulnerabilities most likely to be exploited soon.
What to do
- Check which version of ControlLogix® 5580 (1756-L8z) you run against the affected versions below, and install the vendor's latest release.
- Read the advisory on rockwellautomation.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Rockwell Automation | ControlLogix® 5580 (1756-L8z) | V28 | Not stated |
| Rockwell Automation | GuardLogix® 5580 (1756-L8zS) | V31 | Not stated |
| Rockwell Automation | 1756-EN4TR | V2 | Not stated |
| Rockwell Automation | 1756-EN2T | v5.007(unsigned)/v5.027(signed); 1756-EN2T/D: V10.006 | Not stated |
| Rockwell Automation | 1756-EN2F | v5.007(unsigned)/v5.027(signed); 1756-EN2F/C: V10.009 | Not stated |
| Rockwell Automation | 1756-EN2TR | v5.007(unsigned)/v5.027(signed); 1756-EN2TR/C: V10.007 | Not stated |
| Rockwell Automation | 1756-EN3TR | v5.007(unsigned)/v5.027(signed); 1756-EN3TR/B: V10.007 | Not stated |
| Rockwell Automation | 1756-EN2TP | 1756-EN2TP/A: V10.020 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- PresentThe target must be in a specific state or configuration for the attack to work.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Confidentiality (vulnerable system)
- LowLimited loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- HighSerious loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- HighSerious loss of availability on the vulnerable system.
- Confidentiality (other systems)
- LowLimited loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- HighSerious loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- HighSerious loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (rockwellautomation.com).
Official description
A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Unprotected Alternate Channel
The product protects a primary channel, but it does not use the same level of protection for an alternate channel.
How developers prevent this class of flaw
- Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.
More Unprotected Alternate Channel vulnerabilities (CWE-420)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other vulnerabilities in ControlLogix® 5580 (1756-L8z)
- 7.5 High severity
Recent Unprotected Alternate Channel vulnerabilities
- 10.0 Critical severity
Cisco IOS XE Web UI Privilege Escalation Exploited
- 8.8 High severity
Spotted an error? Tell us.