CVE-2024-7507: Rockwell CompactLogix 5380 DOS Vulnerability

CVE-2024-7507 Overview

CVE-2024-7507 is a denial-of-service vulnerability affecting multiple Rockwell Automation Logix controller families. The flaw occurs when the controller receives a malformed Programmable Controller Communication Commands (PCCC) message, triggering a fault condition. An unauthenticated attacker with network access to the controller can send a crafted PCCC message to cause the device to enter a fault state, interrupting industrial process control. The vulnerability is tracked under [CWE-20] Improper Input Validation and primarily impacts availability of operational technology (OT) assets running affected firmware versions.

Critical Impact
A remote, unauthenticated attacker can fault CompactLogix, ControlLogix, GuardLogix, and Compact GuardLogix controllers by sending a single malformed PCCC message, halting industrial processes.

Affected Products

Rockwell Automation CompactLogix 5380 and CompactLogix 5480 firmware (including version 35.011)
Rockwell Automation ControlLogix 5580 firmware (including version 35.011)
Rockwell Automation GuardLogix 5580, Compact GuardLogix 5380 SIL 2, and Compact GuardLogix 5380 SIL 3 firmware (including version 35.011)

Discovery Timeline

2024-08-14 - CVE-2024-7507 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7507

Vulnerability Analysis

The vulnerability resides in the PCCC message handler used by affected Logix controller firmware. PCCC is a legacy Allen-Bradley industrial protocol commonly tunneled over EtherNet/IP for communication with programmable controllers. When the controller parses an incoming PCCC message, insufficient validation of message structure allows a malformed packet to trigger a controller fault. The resulting fault condition requires operator intervention to clear and may interrupt the control program, affecting downstream physical processes.

The issue is classified under [CWE-20] Improper Input Validation. No authentication is required and no user interaction is involved; the attacker only needs network reachability to the controller's communication interface.

Root Cause

The affected firmware does not adequately validate fields within received PCCC messages before processing. A specifically crafted malformed message reaches controller logic that cannot handle the malformed structure, producing an unrecoverable fault. Because PCCC parsing executes within the controller's communication stack, the fault propagates to the overall controller state rather than being isolated to the communication subsystem.

Attack Vector

Exploitation is performed over the network against TCP/UDP port 44818 (EtherNet/IP) exposed by affected controllers. An attacker with routable access to the OT network sends a single malformed PCCC message to the controller. No credentials, prior session, or user action are required. Industrial networks that expose Logix controllers to flat corporate networks, remote maintenance VPNs, or the public internet are at elevated risk. See the Rockwell Automation Security Advisory for vendor-specific details.

Detection Methods for CVE-2024-7507

Indicators of Compromise

Unexpected major or non-recoverable faults on CompactLogix, ControlLogix, GuardLogix, or Compact GuardLogix controllers running firmware 35.011 or earlier.
Loss of communication or process control immediately following inbound EtherNet/IP traffic from unexpected sources.
Controller event logs showing malformed PCCC command codes or truncated/oversized PCCC payloads prior to the fault.

Detection Strategies

Deploy OT-aware network monitoring that decodes EtherNet/IP and PCCC traffic to flag malformed command structures or atypical PCCC command types.
Baseline legitimate PCCC sources and alert when PCCC messages originate from hosts outside the engineering workstation and HMI inventory.
Correlate controller fault events from asset management tools (for example, FactoryTalk AssetCentre) with network traffic captures to identify triggering packets.

Monitoring Recommendations

Monitor inbound traffic to TCP/UDP port 44818 for unusual volume, source addresses, or protocol anomalies.
Alert on controller mode changes, major faults, or watchdog resets that lack a corresponding authorized engineering action.
Log and review all cross-zone traffic between IT and OT networks that targets Logix controllers.

How to Mitigate CVE-2024-7507

Immediate Actions Required

Inventory all CompactLogix 5380/5480, ControlLogix 5580, GuardLogix 5580, and Compact GuardLogix 5380 SIL 2/SIL 3 controllers and identify firmware versions in use.
Apply the firmware updates referenced in the Rockwell Automation Security Advisory SD1685 on affected controllers at the next available maintenance window.
Restrict network reachability to controller EtherNet/IP interfaces to authorized engineering workstations and HMIs only.
Ensure OT networks are segmented from IT and remote-access networks in accordance with ISA/IEC 62443 zone and conduit guidance.

Patch Information

Rockwell Automation has published remediation guidance in advisory SD1685. Customers should upgrade affected firmware to the fixed versions identified in the Rockwell Automation Security Advisory. Firmware version 35.011 is explicitly listed as affected, so verify the installed version against the vendor's fixed-version table before concluding remediation is complete.

Workarounds

Block inbound EtherNet/IP traffic (TCP/UDP 44818) from untrusted networks at perimeter and cell/area zone firewalls.
Place controllers behind an industrial firewall or data diode that enforces source whitelisting for PCCC-capable clients.
Disable or restrict PCCC communication where it is not operationally required by the control application.
Require VPN with multi-factor authentication for any remote engineering access to the OT environment.

bash

# Example firewall rule restricting EtherNet/IP access to authorized engineering hosts
# Replace ENG_WS_SUBNET and PLC_IP with environment-specific values
iptables -A FORWARD -p tcp -s ENG_WS_SUBNET -d PLC_IP --dport 44818 -j ACCEPT
iptables -A FORWARD -p udp -s ENG_WS_SUBNET -d PLC_IP --dport 44818 -j ACCEPT
iptables -A FORWARD -p tcp -d PLC_IP --dport 44818 -j DROP
iptables -A FORWARD -p udp -d PLC_IP --dport 44818 -j DROP