Skip to content
CVE Tracker
Back

CVE-2024-2425

Rockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527

High7.5EPSS 2.8%
Published
Updated
Reserved
Assigned by
Rockwell

Description

A denial-of-service vulnerability exists in the Rockwell Automation PowerFlex® 527 due to improper input validation in the device. If exploited, the web server will crash and need a manual restart to recover it.

Scores

CVSS scores of CVE-2024-2425, by who scored it
Scored byCVSSScoreVector
RockwellCNA (assigner)3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Analyzed3.1High7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS (exploitation in 30 days)
2.8% · top 13% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

Affected products

  • Rockwell Automation · PowerFlex® 527

    • affected v2.001.x <

What to do

Solution: There is no fix currently for this vulnerability. Users using the affected software are encouraged to apply risk mitigations and security best practices, where possible. * Implement network segmentation confirming the device is on an isolated network. * Disable the web server https://literature.rockwellautomation.com/idc/groups/literature/documents/um/520-um002_-en-e.pdf , if not needed. The web server is disabled by default. Disabling this feature is available in v2.001.x and later. * Security Best Practices https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .