CVE-2024-3493 Overview
CVE-2024-3493 is a denial of service vulnerability affecting multiple Rockwell Automation programmable logic controllers (PLCs) and communication modules. A specific malformed fragmented packet type can cause a Major Non-Recoverable Fault (MNRF) in affected industrial control systems, rendering them unavailable until a manual restart is performed.
This vulnerability is particularly concerning in industrial control system (ICS) and operational technology (OT) environments where PLCs control critical manufacturing processes, safety systems, and industrial automation. The affected devices include ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380, CompactLogix 5480, ControlLogix 5580 Process, CompactLogix 5380 Process, and the 1756-EN4TR communication module.
Critical Impact
Exploitation causes a Major Non-Recoverable Fault (MNRF) requiring manual device restart, potentially resulting in loss of view and control of connected industrial devices and processes.
Affected Products
- Rockwell Automation ControlLogix 5580 (Firmware version 35.011)
- Rockwell Automation GuardLogix 5580 (Firmware version 35.011)
- Rockwell Automation CompactLogix 5380 (Firmware version 35.011)
- Rockwell Automation Compact GuardLogix 5380 (Firmware version 35.011)
- Rockwell Automation CompactLogix 5480 (Firmware version 35.011)
- Rockwell Automation ControlLogix 5580 Process (Firmware version 35.011)
- Rockwell Automation CompactLogix 5380 Process (Firmware version 35.011)
- Rockwell Automation 1756-EN4TR (Firmware version 5.001)
Discovery Timeline
- April 15, 2024 - CVE-2024-3493 published to NVD
- March 4, 2025 - Last updated in NVD database
Technical Details for CVE-2024-3493
Vulnerability Analysis
This vulnerability stems from improper input validation (CWE-20) in the network packet handling routines of affected Rockwell Automation devices. The affected PLCs fail to properly validate and handle malformed fragmented network packets, leading to a critical system fault condition.
When these industrial controllers receive specific malformed fragmented packets—which can be generated automatically by devices transmitting large amounts of data—the firmware's packet reassembly mechanism triggers a Major Non-Recoverable Fault (MNRF). This represents one of the most severe fault conditions in Rockwell Automation PLCs, as MNRF events cannot be cleared through software commands and require physical power cycling of the device.
The network-accessible nature of this vulnerability allows remote, unauthenticated attackers to cause denial of service conditions against critical industrial infrastructure without requiring any privileges or user interaction.
Root Cause
The root cause is classified as improper input validation (CWE-20) in the network stack's fragmented packet handling routines. The firmware fails to properly sanitize or validate incoming fragmented packets before processing them, allowing malformed packet structures to trigger an unrecoverable fault state in the controller's execution environment.
Industrial PLCs like the ControlLogix and CompactLogix families rely on EtherNet/IP protocol communications, which support packet fragmentation for large data transfers. The vulnerability exists in how the firmware processes reassembly of these fragmented packets when they contain malformed or unexpected data structures.
Attack Vector
The attack can be executed remotely over the network without authentication. An attacker with network access to the affected devices can craft and send malformed fragmented packets to trigger the vulnerability. The attack characteristics include:
- Network-based exploitation: Attackers can target devices from anywhere with network connectivity to the PLC
- No authentication required: The vulnerability can be triggered without valid credentials
- No user interaction needed: The attack executes automatically upon packet receipt
- Automatic generation potential: Malformed packets may be generated inadvertently by legitimate devices sending large data volumes
The vulnerability primarily impacts availability, causing complete denial of service to the affected controller and potentially disrupting all connected industrial processes and safety systems.
Detection Methods for CVE-2024-3493
Indicators of Compromise
- Unexpected Major Non-Recoverable Fault (MNRF) events on affected ControlLogix, GuardLogix, or CompactLogix controllers
- Controller fault logs indicating network-related exceptions prior to MNRF
- Unusual fragmented packet traffic patterns targeting affected devices on EtherNet/IP ports
- Multiple devices in an environment experiencing simultaneous MNRF events
Detection Strategies
- Monitor industrial network traffic for malformed or abnormally fragmented EtherNet/IP packets targeting PLCs
- Implement network intrusion detection rules to identify anomalous packet fragmentation patterns
- Configure SIEM correlation rules to alert on MNRF fault events across multiple controllers
- Deploy deep packet inspection at network boundaries to analyze industrial protocol traffic
Monitoring Recommendations
- Enable detailed logging on industrial firewalls and network infrastructure protecting PLC networks
- Monitor controller fault status through HMI/SCADA systems for early detection of MNRF conditions
- Implement network traffic baselining to identify anomalous communication patterns with affected devices
- Configure automated alerts for any MNRF events reported by affected Rockwell Automation controllers
How to Mitigate CVE-2024-3493
Immediate Actions Required
- Review the Rockwell Automation Security Advisory SD1666 for specific patch and firmware update information
- Implement network segmentation to isolate affected PLCs from untrusted network segments
- Configure industrial firewalls to restrict network access to affected controllers to only authorized systems
- Develop and test incident response procedures for rapid recovery from MNRF events
Patch Information
Rockwell Automation has released firmware updates to address this vulnerability. Organizations should consult the official Rockwell Automation Security Advisory SD1666 for specific version information and download instructions. Given the critical nature of industrial control systems, firmware updates should be carefully planned and tested in non-production environments before deployment to production systems.
Affected firmware versions include:
- ControlLogix 5580/GuardLogix 5580/CompactLogix 5380/Compact GuardLogix 5380/CompactLogix 5480 series: Firmware 35.011
- 1756-EN4TR communication module: Firmware 5.001
Workarounds
- Implement strict network segmentation using industrial DMZ architectures to limit network exposure of affected PLCs
- Deploy application-layer firewalls capable of inspecting EtherNet/IP protocol traffic and filtering malformed packets
- Restrict network access to affected devices to only essential systems using access control lists (ACLs)
- Consider implementing redundant controller configurations where feasible to maintain operations during potential attacks
- Establish manual restart procedures and train operations personnel on rapid recovery from MNRF events
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
