CVE-2024-6207 Overview
CVE-2024-6207 is a denial-of-service vulnerability affecting Rockwell Automation Logix-family programmable logic controllers (PLCs). A remote, unauthenticated attacker can send a specially crafted Common Industrial Protocol (CIP) message to the device and disrupt legitimate access. Successful exploitation terminates connections to attached workstations and downstream devices. Recovery requires a full program download to the controller, which terminates any running process. The vulnerability is tracked under [CWE-20] Improper Input Validation and impacts industrial control system (ICS) deployments running affected ControlLogix, GuardLogix, CompactLogix, and FactoryTalk Logix Echo firmware.
Critical Impact
Unauthenticated network attackers can force Logix controllers into a non-operational state, requiring a download and restart that halts any process the controller is executing.
Affected Products
- Rockwell Automation ControlLogix 5580 and ControlLogix 5580 Process firmware
- Rockwell Automation GuardLogix 5580, Compact GuardLogix 5380 SIL 2, and Compact GuardLogix 5380 SIL 3 firmware
- Rockwell Automation CompactLogix 5380, CompactLogix 5480, and FactoryTalk Logix Echo firmware
Discovery Timeline
- 2024-10-14 - CVE-2024-6207 published to NVD
- 2024-10-21 - Last updated in NVD database
Technical Details for CVE-2024-6207
Vulnerability Analysis
The vulnerability resides in how affected Logix controllers parse and handle inbound CIP messages. CIP is the application-layer protocol used by EtherNet/IP for communication between controllers, workstations, and field devices. Improper input validation of a crafted CIP message causes the controller to terminate active sessions and stop accepting new connections from legitimate engineering workstations and connected I/O. Because the controller does not recover automatically, an operator must perform a program download to restore communications. The download itself ends any active process running on the controller, producing a secondary operational impact on physical processes under control.
Root Cause
The root cause is improper validation of fields within an incoming CIP message [CWE-20]. The protocol stack accepts and processes malformed input that places the device into a state where it cannot service further requests. Rockwell Automation tracks this issue in advisory SD1707 and notes the same exploitation vector previously described in CVE-2021-22681.
Attack Vector
An attacker reaches the controller over the network on the EtherNet/IP service port and submits a specially crafted CIP packet. No authentication or user interaction is required. The attack targets only availability — confidentiality and integrity of process data are not directly affected by this flaw. In flat or insufficiently segmented operational technology (OT) networks, any compromised host with line-of-sight to the PLC can deliver the malicious payload. Refer to the Rockwell Automation Security Advisory SD1707 for protocol-level details.
Detection Methods for CVE-2024-6207
Indicators of Compromise
- Unexpected loss of communication between engineering workstations (such as Studio 5000) and Logix controllers.
- Connected I/O devices and HMIs reporting dropped sessions to the controller without a documented change event.
- Controller faults or non-responsive states that clear only after a program download.
Detection Strategies
- Deploy ICS-aware network monitoring that decodes CIP and EtherNet/IP traffic and alerts on malformed CIP service codes or class identifiers.
- Baseline normal CIP traffic patterns per controller, then alert on traffic from non-engineering hosts targeting controller TCP/44818 or UDP/2222.
- Correlate controller connection-drop events with packet captures at the cell or zone boundary to identify the source host.
Monitoring Recommendations
- Forward Logix controller diagnostic logs and EtherNet/IP switch port statistics to a central analytics platform for cross-referencing with network telemetry.
- Monitor for repeated CIP ForwardOpen failures or session resets, which often precede a successful DoS attempt.
- Alert on any new host initiating CIP sessions to a PLC outside of approved engineering and HMI assets.
How to Mitigate CVE-2024-6207
Immediate Actions Required
- Apply the firmware updates referenced in Rockwell Automation advisory SD1707 to all affected ControlLogix, GuardLogix, CompactLogix, and FactoryTalk Logix Echo devices.
- Restrict CIP/EtherNet/IP access (TCP/44818, UDP/2222) to known engineering workstations using firewall rules at the Purdue Level 3/Level 2 boundary.
- Inventory all Logix controllers and confirm firmware revisions against the vendor's fixed-version list.
Patch Information
Rockwell Automation provides fixed firmware versions in advisory SD1707. Customers should consult the advisory for the exact patched revisions per product family and schedule a maintenance window to flash affected controllers. After patching, validate process operation before returning the controller to production.
Workarounds
- Place Logix controllers behind an ICS-aware firewall or data diode and block CIP traffic from untrusted network segments.
- Disable or restrict unused CIP services on the controller where the configuration allows.
- Implement strict network segmentation between IT and OT environments, following ISA/IEC 62443 zone-and-conduit guidance.
- Maintain offline backups of controller programs to accelerate recovery if a download is required to restore availability.
# Example firewall rule: restrict CIP/EtherNet/IP to engineering hosts only
iptables -A FORWARD -p tcp --dport 44818 -s 10.20.30.0/24 -d 10.50.0.0/16 -j ACCEPT
iptables -A FORWARD -p udp --dport 2222 -s 10.20.30.0/24 -d 10.50.0.0/16 -j ACCEPT
iptables -A FORWARD -p tcp --dport 44818 -j DROP
iptables -A FORWARD -p udp --dport 2222 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
