CVE-2024-8626: rockwell automation 1756-en4tr Uncontrolled Resource Consumption
Vulnerability summary
CVE-2024-8626 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in rockwell automation 1756-en4tr. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.3% of scored vulnerabilities.
Timeline
- 08-10-2024PublishedVulnerability first disclosed.
- 08-10-2024Last modifiedVulnerability information updated.
Description
Due to a memory leak, a denial-of-service vulnerability exists in the Rockwell Automation affected products. A malicious actor could exploit this vulnerability by performing multiple actions on certain web pages of the product causing the affected products to become fully unavailable and require a power cycle to recover.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.7HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.52%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.52% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Affected systems
Rockwellautomation6 products
- 1756-en4tr_firmware3.002
- compact_guardlogix_5380_firmware≥ 33.011, < 33.015
- compactlogix_5380_firmware≥ 33.011, < 33.015
- compactlogix_5480_firmware≥ 33.011, < 33.015
- controllogix_5580_firmware≥ 33.011, < 33.015
Rockwell automation5 products
- 1756-en4trv3.002
- compact guardlogix® 5380 controllersv33.011<
- compactlogix 5380 controllersv33.011 <
- compactlogix 5480 controllersv33.011<
- guardlogix 5580 controllersv33.011<
2 vendors · 11 products