CVE-2022-1797
Rockwell Automation Logix Controllers Uncontrolled Resource Consumption
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | Medium6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H |
| NVDNVD · Modified | 3.1 | High8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 2.2% · top 18% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.8.
Weakness
Affected products
Rockwell Automation · CompactLogix 5380 controllers
- affected unspecified – ≤ 32.013
Rockwell Automation · Compact GuardLogix 5380 controllers
- affected unspecified – ≤ 32.013
Rockwell Automation · CompactLogix 5480 controllers
- affected unspecified – ≤ 32.013
Rockwell Automation · ControlLogix 5580 controllers
- affected unspecified – ≤ 32.013
Rockwell Automation · GuardLogix 5580 controllers
- affected unspecified – ≤ 32.013
Rockwell Automation · CompactLogix 5370 controllers
- affected unspecified – ≤ 33.013
Rockwell Automation · Compact GuardLogix 5370 controllers
- affected unspecified – ≤ 33.013
Rockwell Automation · ControlLogix 5570 controllers
- affected unspecified – ≤ 33.013
Rockwell Automation · GuardLogix 5570 controllers
- affected 33.013
What to do
Solution: Rockwell Automation recommends users update to the latest firmware version to mitigate this vulnerability. Users are directed towards the risk mitigation provided below and are encouraged (where possible) to combine these with the general security guidelines below to employ multiple strategies simultaneously. Users should go to Rockwell Automation's Product Compatibility & Download Center to download the latest firmware. CompactLogix 5380, Compact GuardLogix 5380, CompactLogix 5480, ControlLogix 5580, GuardLogix 5580: Upgrade to v33.011 firmware CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, GuardLogix 5570: Upgrade to v34.011 firmware Please see Rockwell Automation’s security advisory PN1596 for more information. https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135559
Workaround: If upgrading is not possible, Rockwell Automation recommends the following mitigations: Use of Microsoft AppLocker or other similar allow list applications can help mitigate risk. Information on using AppLocker with products from Rockwell Automation is available in Knowledgebase article QA17329. Confirm the least-privilege user principle is followed, and user/service account access to shared resources (such as a database) is only granted with a minimum number of rights as needed. Please see Rockwell Automation’s security advisory PN1596 for more information. https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135559
References (2)
- https://www.cisa.gov/uscert/ics/advisories/icsa-22-144-01 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135559 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-1797)Record last updated .