Sign-up

ID

VAR-201705-3537


CVE

CVE-2017-6024


TITLE

Rockwell Automation Remote Denial of Service Vulnerability

Trust: 0.8

sources: IVD: d8ac2573-223b-482d-a969-c783c7262aac // CNVD: CNVD-2017-07081

DESCRIPTION

A Resource Exhaustion issue was discovered in Rockwell Automation ControlLogix 5580 controllers V28.011, V28.012, and V28.013; ControlLogix 5580 controllers V29.011; CompactLogix 5380 controllers V28.011; and CompactLogix 5380 controllers V29.011. This vulnerability may allow an attacker to cause a denial of service condition by sending a series of specific CIP-based commands to the controller. Rockwell Automation is a company that provides industrial automation, power, control and information solutions. An attacker can exploit this issue to cause denial-of-service condition. The following products are affected: Rockwell Automation ControlLogix 5580 controller versions 28.011, 28.012, 28.013, and 29.011

Trust: 2.7

sources: NVD: CVE-2017-6024 // JVNDB: JVNDB-2017-003938 // CNVD: CNVD-2017-07081 // BID: 98309 // IVD: d8ac2573-223b-482d-a969-c783c7262aac // VULHUB: VHN-114227

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: d8ac2573-223b-482d-a969-c783c7262aac // CNVD: CNVD-2017-07081

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:controllogix 5580scope:eqversion:v28.011

Trust: 1.6

vendor:rockwellautomationmodel:controllogix 5580scope:eqversion:v29.011

Trust: 1.6

vendor:rockwellautomationmodel:controllogix 5580scope:eqversion:v28.013

Trust: 1.6

vendor:rockwellautomationmodel:controllogix 5580scope:eqversion:v28.012

Trust: 1.6

vendor:rockwellautomationmodel:compactlogix 5380scope:eqversion:v29.011

Trust: 1.0

vendor:rockwellautomationmodel:compactlogix 5380scope:eqversion:v28.011

Trust: 1.0

vendor:rockwellmodel:automation controllogixscope:eqversion:558029.011

Trust: 0.9

vendor:rockwell automationmodel:compactlogix 5380 controllerscope:eqversion:28.011

Trust: 0.8

vendor:rockwell automationmodel:compactlogix 5380 controllerscope:eqversion:29.011

Trust: 0.8

vendor:rockwell automationmodel:controllogix 5580 controllerscope:eqversion:28.011

Trust: 0.8

vendor:rockwell automationmodel:controllogix 5580 controllerscope:eqversion:28.012

Trust: 0.8

vendor:rockwell automationmodel:controllogix 5580 controllerscope:eqversion:28.013

Trust: 0.8

vendor:rockwell automationmodel:controllogix 5580 controllerscope:eqversion:29.011

Trust: 0.8

vendor:rockwellmodel:automation controllogix controllersscope:eqversion:5580v28.011

Trust: 0.6

vendor:rockwellmodel:automation controllogix controllersscope:eqversion:5580v28.012

Trust: 0.6

vendor:rockwellmodel:automation controllogix controllersscope:eqversion:5580v28.013

Trust: 0.6

vendor:rockwellmodel:automation controllogix controllersscope:eqversion:5580v29.011

Trust: 0.6

vendor:rockwellmodel:automation compactlogix controllersscope:eqversion:5380v28.011

Trust: 0.6

vendor:rockwellmodel:automation compactlogix controllersscope:eqversion:5380v29.011

Trust: 0.6

vendor:rockwellautomationmodel:compactlogix 5830scope:eqversion:v28.011

Trust: 0.6

vendor:rockwellautomationmodel:compactlogix 5830scope:eqversion:v29.011

Trust: 0.6

vendor:rockwellmodel:automation controllogixscope:eqversion:558028.013

Trust: 0.3

vendor:rockwellmodel:automation controllogixscope:eqversion:558028.012

Trust: 0.3

vendor:rockwellmodel:automation controllogixscope:eqversion:558028.011

Trust: 0.3

vendor:rockwellmodel:automation compactlogixscope:eqversion:538029.011

Trust: 0.3

vendor:rockwellmodel:automation compactlogixscope:eqversion:538028.011

Trust: 0.3

vendor:rockwellmodel:automation controllogixscope:neversion:558030.011

Trust: 0.3

vendor:rockwellmodel:automation compactlogixscope:neversion:538030.011

Trust: 0.3

vendor:compactlogix 5830model: - scope:eqversion:v28.011

Trust: 0.2

vendor:compactlogix 5830model: - scope:eqversion:v29.011

Trust: 0.2

vendor:controllogix 5580model: - scope:eqversion:v28.011

Trust: 0.2

vendor:controllogix 5580model: - scope:eqversion:v28.012

Trust: 0.2

vendor:controllogix 5580model: - scope:eqversion:v28.013

Trust: 0.2

vendor:controllogix 5580model: - scope:eqversion:v29.011

Trust: 0.2

sources: IVD: d8ac2573-223b-482d-a969-c783c7262aac // CNVD: CNVD-2017-07081 // BID: 98309 // JVNDB: JVNDB-2017-003938 // CNNVD: CNNVD-201702-588 // NVD: CVE-2017-6024

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2017-6024
value: MEDIUM

Trust: 1.0

NVD: CVE-2017-6024
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2017-07081
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201702-588
value: MEDIUM

Trust: 0.6

IVD: d8ac2573-223b-482d-a969-c783c7262aac
value: MEDIUM

Trust: 0.2

VULHUB: VHN-114227
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2017-6024
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2017-07081
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: d8ac2573-223b-482d-a969-c783c7262aac
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-114227
severity: HIGH
baseScore: 7.1
vectorString: AV:N/AC:M/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 8.6
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2017-6024
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2017-6024
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: d8ac2573-223b-482d-a969-c783c7262aac // CNVD: CNVD-2017-07081 // VULHUB: VHN-114227 // JVNDB: JVNDB-2017-003938 // CNNVD: CNNVD-201702-588 // NVD: CVE-2017-6024

PROBLEMTYPE DATA

problemtype:CWE-400

Trust: 1.9

sources: VULHUB: VHN-114227 // JVNDB: JVNDB-2017-003938 // NVD: CVE-2017-6024

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201702-588

TYPE

Resource management error

Trust: 0.8

sources: IVD: d8ac2573-223b-482d-a969-c783c7262aac // CNNVD: CNNVD-201702-588

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2017-003938

PATCH
title:ControlLogix 5580コントローラurl:http://ab.rockwellautomation.com/ja/Programmable-Controllers/ControlLogix/5580-Controllers
Trust: 0.8
title:CompactLogix 5380コントローラurl:http://ab.rockwellautomation.com/ja/Programmable-Controllers/CompactLogix-5380-Controllers
Trust: 0.8
title:Rockwell Automation Remote Denial of Service Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/94056
Trust: 0.6
title:Multiple Rockwell Automation Product security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99644
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2017-07081 // 
            
            
            
            JVNDB: JVNDB-2017-003938 // 
            
            
            
            CNNVD: CNNVD-201702-588

EXTERNAL IDS
db:NVDid:CVE-2017-6024
Trust: 3.6
db:ICS CERTid:ICSA-17-094-05
Trust: 2.8
db:BIDid:98309
Trust: 2.6
db:CNVDid:CNVD-2017-07081
Trust: 0.8
db:CNNVDid:CNNVD-201702-588
Trust: 0.8
db:JVNDBid:JVNDB-2017-003938
Trust: 0.8
db:IVDid:D8AC2573-223B-482D-A969-C783C7262AAC
Trust: 0.2
db:VULHUBid:VHN-114227
Trust: 0.1
sources:
            
            
            IVD: d8ac2573-223b-482d-a969-c783c7262aac // 
            
            
            
            CNVD: CNVD-2017-07081 // 
            
            
            
            VULHUB: VHN-114227 // 
            
            
            
            BID: 98309 // 
            
            
            
            JVNDB: JVNDB-2017-003938 // 
            
            
            
            CNNVD: CNNVD-201702-588 // 
            
            
            
            NVD: CVE-2017-6024

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-17-094-05
Trust: 2.8
url:http://www.securityfocus.com/bid/98309
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2017-6024
Trust: 1.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6024
Trust: 0.8
url:http://compatibility.rockwellautomation.com/pages/multiproductdownload.aspx?keyword=1756-l8&crumb=112
Trust: 0.6
url:https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1041420
Trust: 0.6
url:http://www.rockwellautomation.com/security/overview.page
Trust: 0.6
url:http://www.rockwellautomation.com/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2017-07081 // 
            
            
            
            VULHUB: VHN-114227 // 
            
            
            
            BID: 98309 // 
            
            
            
            JVNDB: JVNDB-2017-003938 // 
            
            
            
            CNNVD: CNNVD-201702-588 // 
            
            
            
            NVD: CVE-2017-6024

CREDITS
The vendor reported this issue.
Trust: 0.3
sources:
            
            
            BID: 98309

SOURCES
db:IVDid:d8ac2573-223b-482d-a969-c783c7262aac
db:CNVDid:CNVD-2017-07081
db:VULHUBid:VHN-114227
db:BIDid:98309
db:JVNDBid:JVNDB-2017-003938
db:CNNVDid:CNNVD-201702-588
db:NVDid:CVE-2017-6024

LAST UPDATE DATE
2025-04-20T23:05:04.281000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2017-07081date:2017-05-19T00:00:00
db:VULHUBid:VHN-114227date:2019-10-09T00:00:00
db:BIDid:98309date:2017-05-23T16:23:00
db:JVNDBid:JVNDB-2017-003938date:2017-06-12T00:00:00
db:CNNVDid:CNNVD-201702-588date:2019-10-17T00:00:00
db:NVDid:CVE-2017-6024date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:IVDid:d8ac2573-223b-482d-a969-c783c7262aacdate:2017-05-19T00:00:00
db:CNVDid:CNVD-2017-07081date:2017-05-19T00:00:00
db:VULHUBid:VHN-114227date:2017-05-06T00:00:00
db:BIDid:98309date:2017-05-04T00:00:00
db:JVNDBid:JVNDB-2017-003938date:2017-06-12T00:00:00
db:CNNVDid:CNNVD-201702-588date:2017-02-17T00:00:00
db:NVDid:CVE-2017-6024date:2017-05-06T00:29:00.163