Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2024-6242

Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Rockwell

Description

A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Rockwell Automation ControlLogix® 5580 (1756-L8z)

Default version status: unaffected

  • V28affected

Rockwell Automation GuardLogix® 5580 (1756-L8zS)

Default version status: unaffected

  • V31affected

Rockwell Automation 1756-EN4TR

Default version status: unaffected

  • V2affected

Rockwell Automation 1756-EN2T

Default version status: unaffected

  • v5.007(unsigned)/v5.027(signed)affected

Rockwell Automation 1756-EN2F

Default version status: unaffected

  • v5.007(unsigned)/v5.027(signed)affected

Rockwell Automation 1756-EN2TR

Default version status: unaffected

  • v5.007(unsigned)/v5.027(signed)affected

Rockwell Automation 1756-EN3TR

Default version status: unaffected

  • v5.007(unsigned)/v5.027(signed)affected

Rockwell Automation 1756-EN2T

Default version status: unaffected

  • 1756-EN2T/D: V10.006affected

Rockwell Automation 1756-EN2F

Default version status: unaffected

  • 1756-EN2F/C: V10.009affected

Rockwell Automation 1756-EN2TR

Default version status: unaffected

  • 1756-EN2TR/C: V10.007affected

Rockwell Automation 1756-EN3TR

Default version status: unaffected

  • 1756-EN3TR/B: V10.007affected

Rockwell Automation 1756-EN2TP

Default version status: unaffected

  • 1756-EN2TP/A: V10.020affected

References