CVE-2024-7507 – CVE-2024-7507 is a denial-of-service vulnerabil... (How to Fix)

Q: What is the severity of CVE-2024-7507?

CVE-2024-7507 has a CVSS score of 6.5 (MEDIUM). CVE-2024-7507 is a denial-of-service vulnerability in Rockwell Automation controllers where receiving a malformed PCCC message causes the controller to fault and stop functioning. This affects industrial control systems using vulnerable Rockwell products, potentially disrupting manufacturing, energy, or critical infrastructure operations.

📋 TL;DR

CVE-2024-7507 is a denial-of-service vulnerability in Rockwell Automation controllers where receiving a malformed PCCC message causes the controller to fault and stop functioning. This affects industrial control systems using vulnerable Rockwell products, potentially disrupting manufacturing, energy, or critical infrastructure operations.

💻 Affected Systems

Products:

Rockwell Automation controllers with PCCC protocol support

Versions: Specific versions not detailed in advisory; check vendor documentation

Operating Systems: Embedded controller firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Affects controllers with PCCC protocol enabled; exact product list requires checking Rockwell advisory SD 1685

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete shutdown of industrial processes causing production stoppage, safety system failures, or infrastructure disruption with potential physical consequences.

🟠

Likely Case

Temporary controller outage requiring manual restart, causing production delays and minor operational disruption.

🟢

If Mitigated

Isolated controller failure with redundant systems maintaining operations while affected unit is restarted.

🌐 Internet-Facing: MEDIUM - Requires network access to controller but many industrial systems have limited internet exposure.

🏢 Internal Only: HIGH - Internal attackers or compromised systems can easily send malformed PCCC packets to vulnerable controllers.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Simple malformed packet can trigger the fault; no authentication required if network access exists.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Rockwell advisory SD 1685 for specific firmware updates

Vendor Advisory: https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201685.html

Restart Required: Yes

Instructions:

1. Review Rockwell advisory SD 1685. 2. Identify affected controller models. 3. Download and apply firmware updates from Rockwell. 4. Restart controllers after patching. 5. Validate functionality.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate controllers from untrusted networks using firewalls or network segmentation

PCCC Protocol Restriction

all

Disable PCCC protocol if not required for operations

🧯 If You Can't Patch

Implement strict network access controls allowing only trusted devices to communicate with controllers
Deploy intrusion detection systems monitoring for malformed PCCC traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check controller firmware version against Rockwell's patched versions list in advisory SD 1685

Check Version:

Controller-specific command via programming software (e.g., RSLogix/Studio 5000)

Verify Fix Applied:

Verify firmware version matches patched version and test with legitimate PCCC traffic

📡 Detection & Monitoring

Log Indicators:

Controller fault logs
Unexpected controller restarts
PCCC protocol errors

Network Indicators:

Malformed PCCC packets
Unusual PCCC traffic patterns
Controller communication failures

SIEM Query:

source="industrial_controller" AND (event_type="fault" OR protocol="PCCC") AND packet_size:abnormal

📊 Metadata

CVE ID: CVE-2024-7507

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-20

Published: August 14, 2024

Last Updated: March 4, 2025

🔗 References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD%201685.html Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-7507, you might also want to check these: