Sign-up

ID

VAR-202403-2157


CVE

CVE-2024-2426


TITLE

Rockwell Automation  of  PowerFlex 527 AC Drive  Firmware vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2024-018446

DESCRIPTION

A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, a disruption in the CIP communication will occur and a manual restart will be required by the user to recover it. Rockwell Automation of PowerFlex 527 AC Drive There are unspecified vulnerabilities in the firmware.Service operation interruption (DoS) It may be in a state. Rockwell Automation PowerFlex 525 is an adjustable AC inverter from Rockwell Automation, USA

Trust: 2.16

sources: NVD: CVE-2024-2426 // JVNDB: JVNDB-2024-018446 // CNVD: CNVD-2024-18335

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-18335

AFFECTED PRODUCTS

vendor:rockwellautomationmodel:powerflex 527 ac drivesscope:gteversion:2.001

Trust: 1.0

vendor:rockwell automationmodel:powerflex 527 ac drivescope:eqversion: -

Trust: 0.8

vendor:rockwell automationmodel:powerflex 527 ac drivescope: - version: -

Trust: 0.8

vendor:rockwell automationmodel:powerflex 527 ac drivescope:eqversion:powerflex 527 ac drive firmware 2.001 that's all

Trust: 0.8

vendor:rockwellmodel:automation powerflexscope:eqversion:527>v2.001.x

Trust: 0.6

sources: CNVD: CNVD-2024-18335 // JVNDB: JVNDB-2024-018446 // NVD: CVE-2024-2426

CVSS

SEVERITY

CVSSV2

CVSSV3

PSIRT@rockwellautomation.com: CVE-2024-2426
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2024-2426
value: HIGH

Trust: 1.0

NVD: CVE-2024-2426
value: HIGH

Trust: 0.8

CNVD: CNVD-2024-18335
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-18335
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

PSIRT@rockwellautomation.com: CVE-2024-2426
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 2.0

NVD: CVE-2024-2426
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-18335 // JVNDB: JVNDB-2024-018446 // NVD: CVE-2024-2426 // NVD: CVE-2024-2426

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:Inappropriate input confirmation (CWE-20) [ others ]

Trust: 0.8

problemtype: Lack of information (CWE-noinfo) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-018446 // NVD: CVE-2024-2426

PATCH

title:Patch for Rockwell Automation PowerFlex 527 Input Validation Error Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/543386

Trust: 0.6

sources: CNVD: CNVD-2024-18335

EXTERNAL IDS

db:NVDid:CVE-2024-2426

Trust: 3.2

db:ICS CERTid:ICSA-24-086-02

Trust: 0.8

db:JVNid:JVNVU95922371

Trust: 0.8

db:JVNDBid:JVNDB-2024-018446

Trust: 0.8

db:CNVDid:CNVD-2024-18335

Trust: 0.6

sources: CNVD: CNVD-2024-18335 // JVNDB: JVNDB-2024-018446 // NVD: CVE-2024-2426

REFERENCES

url:https://www.rockwellautomation.com/en-us/support/advisory.sd1664.html

Trust: 1.8

url:https://jvn.jp/vu/jvnvu95922371/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-2426

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-24-086-02

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2024-2426/

Trust: 0.6

sources: CNVD: CNVD-2024-18335 // JVNDB: JVNDB-2024-018446 // NVD: CVE-2024-2426

SOURCES

db:CNVDid:CNVD-2024-18335
db:JVNDBid:JVNDB-2024-018446
db:NVDid:CVE-2024-2426

LAST UPDATE DATE

2025-02-09T22:49:44.896000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-18335date:2024-04-17T00:00:00
db:JVNDBid:JVNDB-2024-018446date:2025-02-07T08:41:00
db:NVDid:CVE-2024-2426date:2025-01-31T15:41:55.917

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-18335date:2024-04-17T00:00:00
db:JVNDBid:JVNDB-2024-018446date:2025-02-07T00:00:00
db:NVDid:CVE-2024-2426date:2024-03-25T21:15:47.480