CVE-2016-9343: rockwellautomation 1768_compact_guardlogix_l4xs_controller_firmware Out-of-bounds Write
Vulnerability summary
CVE-2016-9343 is a critical (CVSS 10.0) Out-of-bounds Write vulnerability in rockwellautomation 1768_compact_guardlogix_l4xs_controller_firmware. EPSS estimates a 10.49% chance of exploitation in the next 30 days, higher than 95.7% of scored vulnerabilities.
Timeline
- 13-02-2017PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in Rockwell Automation Logix5000 Programmable Automation Controller FRN 16.00 through 21.00 (excluding all firmware versions prior to FRN 16.00, which are not affected). By sending malformed common industrial protocol (CIP) packet, an attacker may be able to overflow a stack-based buffer and execute code on the controller or initiate a nonrecoverable fault resulting in a denial of service.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
10.49%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 10.49% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Rockwellautomation16 products
- 1768_compact_guardlogix_l4xs_controller_firmware18.00 | 19.00 | 20.00 | 20.011 | 20.013
- 1768_compactlogix_l4x_controller_firmware16.00 | 16.020 | 16.025 | 17.00 | 18.00 | 19.00 | 20.00 | 20.011 | 20.016
- 1769_compactlogix_5370_l1_controller_firmware20.00 | 20.010 | 20.013 | 21.00
- 1769_compactlogix_5370_l2_controller_firmware20.00 | 20.010 | 20.013 | 21.00
- 1769_compactlogix_5370_l3_controller_firmware20.00 | 20.010 | 20.013 | 21.00
1 vendor · 16 products
References
2 links- ics-cert.us-cert.gov/advisories/ICSA-16-343-05X Refsource MISCThird Party AdvisoryUS Government Resource