Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix: 1 CVE, High 7.5
Summary
CISA reports 1 vulnerability in Rockwell Automation ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380 and 1 more. Weakness type: Loop with Unreachable Exit Condition ('Infinite Loop'). Successful exploitation of this vulnerability could result in a major nonrecoverable fault (MNRF), requiring a program download or stage 2 reset to recover. Highest CVSS v3 score: 7.5 (High), exploitable over the network.
At a glance
- Vendor
- Rockwell Automation
- Products
- ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380, CompactLogix 5480
- CVEs
- CVE-2021-42260
- Highest CVSS v3
- 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2021-42260 | Loop with Unreachable Exit Condition ('Infinite Loop') | 7.5 | – | No | A potential denial of service vulnerability exists in the affected products and can be triggered via corrupt crafted data. This could result in a major nonrecoverable fault (MNRF). A program download is required to recover safety controllers. For non-safety controllers, a stage 2 reset is required to recover. |
Affected products (20)
- Rockwell Automation ControlLogix 5580 <34.015
- Rockwell Automation ControlLogix 5580 <35.014
- Rockwell Automation ControlLogix 5580 <36.013
- Rockwell Automation ControlLogix 5580 <37.011
- Rockwell Automation GuardLogix 5580 <34.015
- Rockwell Automation GuardLogix 5580 <35.014
- Rockwell Automation GuardLogix 5580 <36.013
- Rockwell Automation GuardLogix 5580 <37.011
- Rockwell Automation CompactLogix 5380 <34.015
- Rockwell Automation CompactLogix 5380 <35.014
- Rockwell Automation CompactLogix 5380 <36.013
- Rockwell Automation CompactLogix 5380 <37.011
- Rockwell Automation Compact GuardLogix 5380 <34.015
- Rockwell Automation Compact GuardLogix 5380 <35.014
- Rockwell Automation Compact GuardLogix 5380 <36.013
- Rockwell Automation Compact GuardLogix 5380 <37.011
- Rockwell Automation CompactLogix 5480 <34.015
- Rockwell Automation CompactLogix 5480 <35.014
- Rockwell Automation CompactLogix 5480 <36.013
- Rockwell Automation CompactLogix 5480 <37.011
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Rockwell Automation recommends users update to firmware version 34.015 and later.
- Vendor Fix: Rockwell Automation recommends users update to firmware version 35.014 and later.
- Vendor Fix: Rockwell Automation recommends users update to firmware version 36.013 and later.
- Vendor Fix: Rockwell Automation recommends users update to firmware version 37.011 and later.
- Mitigation: Customers using the affected software who are not able to upgrade to one of the corrected versions should use Rockwell Automation's security best practices.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.