CVE-2024-6077 – A denial-of-service vulnerability in Rockwell A... (How to Fix)

Q: What is the severity of CVE-2024-6077?

CVE-2024-6077 has a CVSS score of 7.5 (HIGH). A denial-of-service vulnerability in Rockwell Automation products allows attackers to send specially crafted packets to the CIP Security Object, causing the device to become unavailable and require a factory reset. This affects industrial control systems using vulnerable Rockwell Automation products. Organizations using these devices in operational technology environments are at risk.

📋 TL;DR

A denial-of-service vulnerability in Rockwell Automation products allows attackers to send specially crafted packets to the CIP Security Object, causing the device to become unavailable and require a factory reset. This affects industrial control systems using vulnerable Rockwell Automation products. Organizations using these devices in operational technology environments are at risk.

💻 Affected Systems

Products:

Rockwell Automation products with CIP Security Object functionality

Versions: Specific versions listed in Rockwell advisory SD1963

Operating Systems: Embedded/real-time OS on Rockwell industrial devices

Default Config Vulnerable: ⚠️ Yes

Notes: Devices must have CIP Security Object enabled and be network accessible. Check Rockwell advisory SD1963 for specific product and version details.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Critical industrial control system becomes completely unavailable, requiring physical factory reset and causing extended operational downtime in manufacturing or critical infrastructure.

🟠

Likely Case

Targeted device becomes unresponsive, requiring maintenance intervention and causing temporary disruption to industrial processes.

🟢

If Mitigated

Network segmentation and proper firewall rules prevent malicious packets from reaching vulnerable devices, minimizing operational impact.

🌐 Internet-Facing: HIGH if vulnerable devices are directly exposed to the internet, as exploitation requires only network access.

🏢 Internal Only: MEDIUM to HIGH depending on network segmentation and internal security controls, as exploitation requires network access to the device.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted packets to the CIP Security Object, which is network-based and doesn't require authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Rockwell advisory SD1963 for specific fixed versions per product

Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1963.html

Restart Required: Yes

Instructions:

1. Review Rockwell advisory SD1963 for affected products. 2. Download appropriate firmware updates from Rockwell support portal. 3. Follow Rockwell's firmware update procedures for your specific device. 4. Test in non-production environment first. 5. Apply during maintenance window as restart is required.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate vulnerable devices in separate network segments with strict firewall rules

Access Control Lists

all

Implement ACLs to restrict access to CIP Security Object ports from trusted sources only

🧯 If You Can't Patch

Implement strict network segmentation to isolate vulnerable devices from untrusted networks
Deploy intrusion detection systems to monitor for malicious CIP traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check device firmware version against affected versions in Rockwell advisory SD1963

Check Version:

Device-specific commands vary by Rockwell product; typically through device web interface or Studio 5000 software

Verify Fix Applied:

Verify firmware version matches or exceeds fixed versions listed in Rockwell advisory

📡 Detection & Monitoring

Log Indicators:

Device becoming unresponsive
CIP Security Object error messages
Network connection drops

Network Indicators:

Unusual traffic patterns to CIP ports
Malformed CIP packets
Multiple connection attempts to device

SIEM Query:

source_ip=* AND dest_port IN (44818, 2222) AND protocol=TCP AND packet_size>threshold

📊 Metadata

CVE ID: CVE-2024-6077

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-20

Published: September 12, 2024

Last Updated: September 19, 2024

🔗 References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1963.html Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-6077, you might also want to check these: