CVE-2022-3752

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-3752
An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-of-service condition in Rockwell Automation Logix controllers resulting in a major non-recoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online and continue normal operation.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137664 Permissions Required Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:h:rockwellautomation:compactlogix_5480:-:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:compactlogix_5480_firmware:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:h:rockwellautomation:compactlogix_5580:-:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:compactlogix_5580_firmware:*:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:h:rockwellautomation:guardlogix_5580:-:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:guardlogix_5580_firmware:*:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:h:rockwellautomation:compact_guardlogix_5380:-:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:compact_guardlogix_5380_firmware:*:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:h:rockwellautomation:compactlogix_5380:-:*:*:*:*:*:*:*
cpe:2.3:o:rockwellautomation:compactlogix_5380_firmware:*:*:*:*:*:*:*:*
History

07 Nov 2023, 03:51

Type Values Removed Values Added
Summary An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-of-service condition in Rockwell Automation Logix controllers resulting in a major non-recoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online and continue normal operation. An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-of-service condition in Rockwell Automation Logix controllers resulting in a major non-recoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online and continue normal operation.
Information

Published : 2022-12-19 23:15

Updated : 2024-02-28 19:51

NVD link : CVE-2022-3752

Mitre link : CVE-2022-3752

CVE.ORG link : CVE-2022-3752

JSON object : View

Products Affected

rockwellautomation

  • compactlogix_5480
  • compactlogix_5580_firmware
  • compactlogix_5580
  • compact_guardlogix_5380
  • compactlogix_5380_firmware
  • compactlogix_5480_firmware
  • compactlogix_5380
  • compact_guardlogix_5380_firmware
  • guardlogix_5580_firmware
  • guardlogix_5580
CWE
NVD-CWE-noinfo CWE-20

Improper Input Validation