Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix

View CSAF Summary The following versions of Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix are affected: ControlLogix 5580 <34.015, <35.014, <36.013, <37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) GuardLogix 5580 <34.015, <35.014, <36.013, <37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) CompactLogix 5380 <34.015, <35.014, <36.013, <37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) Compact GuardLogix 5380 <34.015, <35.014, <36.013, <37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) CompactLogix 5480 <34.015, <35.014, <36.013, <37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) CVSS Vendor Equipment Vulnerabilities v3 7.5 Rockwell Automation Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix Loop with Unreachable Exit Condition ('Infinite Loop') Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2021-42260 A potential denial of service vulnerability exists in the affected products and can be triggered via corrupt crafted data. This could result in a major nonrecoverable fault (MNRF). A program download is required to recover safety controllers. For non-safety controllers, a stage 2 reset is required to recover. View CVE Details Affected Products Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix Vendor: Rockwell Automation Product Version: Rockwell Automation ControlLogix 5580 <34.015, Rockwell Automation ControlLogix 5580 <35.014, Rockwell Automation ControlLogix 5580 <36.013, Rockwell Automation ControlLogix 5580 <37.011, Rockwell Automation GuardLogix 5580 <34.015, Rockwell Automation GuardLogix 5580 <35.014, Rockwell Automation GuardLogix 5580 <36.013, Rockwell Automation GuardLogix 5580 <37.011, Rockwell Automation CompactLogix 5380 <34.015, Rockwell Automation CompactLogix 5380 <35.014, Rockwell Automation CompactLogix 5380 <36.013, Rockwell Automation CompactLogix 5380 <37.011, Rockwell Automation Compact GuardLogix 5380 <34.015, Rockwell Automation Compact GuardLogix 5380 <35.014, Rockwell Automation Compact GuardLogix 5380 <36.013, Rockwell Automation Compact GuardLogix 5380 <37.011, Rockwell Automation CompactLogix 5480 <34.015, Rockwell Automation CompactLogix 5480 <35.014, Rockwell Automation CompactLogix 5480 <36.013, Rockwell Automation CompactLogix 5480 <37.011 Product Status: known_affected Remediations Vendor fix Rockwell Automation recommends users update to firmware version 34.015 and later. Vendor fix Rockwell Automation recommends users update to firmware version 35.014 and later. Vendor fix Rockwell Automation recommends users update to firmware version 36.013 and later. Vendor fix Rockwell Automation recommends users update to firmware version 37.011 and later. Mitigation Customers using the affected software who are not able to upgrade to one of the corrected versions should use Rockwell Automation's security best practices. Relevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H 4.0 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Acknowledgments Rockwell Automation reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system n