CVE-2020-6998: rockwell automation armor compact guardlogix 5370 controllers Improper Input Validation
Vulnerability summary
CVE-2020-6998 is a high (CVSS 8.6) Improper Input Validation vulnerability in rockwell automation armor compact guardlogix 5370 controllers. EPSS estimates a 3.16% chance of exploitation in the next 30 days, higher than 87.8% of scored vulnerabilities.
Timeline
- 27-07-2022PublishedVulnerability first disclosed.
- 17-04-2025Last modifiedVulnerability information updated.
Description
The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creating an infinite loop. This may allow an attacker to send specially crafted CIP packet requests to a controller, which may cause denial-of-service conditions in communications with other products.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
EPSS trend
Probability
3.16%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
+0.89 pp
From 2.27% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Rockwellautomation9 products
- armor_compact_guardlogix_5370_firmware≤ 33
- compact_guardlogix_5370_firmware≤ 33
- compactlogix_5370_l1_firmware≤ 33
- compactlogix_5370_l2_firmware≤ 33
- compactlogix_5370_l3_firmware≤ 33
Rockwell automation7 products
- armor compact guardlogix 5370 controllers≥ unspecified, ≤ versions 33 and prior
- armor guardlogix safety controllers≥ unspecified, ≤ versions 33 and prior
- compact guardlogix 5370 controllers≥ unspecified, ≤ versions 33 and prior
- compactlogix 5370 l1 controllers≥ unspecified, ≤ versions 33 and prior
- compactlogix 5370 l2 controllers≥ unspecified, ≤ versions 33 and prior
2 vendors · 16 products
References
2 links
www.cisa.gov/uscert/ics/advisories/icsa-21-061-02X Refsource CONFIRMThird Party AdvisoryUS Government Resource- rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398X Refsource CONFIRMPermissions RequiredVendor Advisory