Rockwellautomation Compact Guardlogix 5370 Firmware vulnerabilities

5 CVEs affecting Rockwellautomation Compact Guardlogix 5370 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-3157, published 2022-12-16.

More from Rockwellautomation.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-10954, published 2019-05-01. High severity, CVSS 7.5. EPSS: 6.1% chance of exploitation in the next 30 days. An attacker could send crafted SMTP packets to cause a denial-of-service condition where the controller enters a major non-recoverable faulted state (MNRF) in CompactLogix 5370 L1, L2, and L3…
• CVE-2022-1161, published 2022-04-11. Critical severity, CVSS 9.8. EPSS: 5.2% chance of exploitation in the next 30 days. An attacker with the ability to modify a user program may change user program code on some ControlLogix, CompactLogix, and GuardLogix Control systems. Studio 5000 Logix Designer writes user-readable…
• CVE-2020-6998, published 2022-07-27. High severity, CVSS 8.6. EPSS: 3.2% chance of exploitation in the next 30 days. The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution,…
• CVE-2022-1797, published 2022-06-02. High severity, CVSS 8.6. EPSS: 2.1% chance of exploitation in the next 30 days. A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable…
• CVE-2022-3157, published 2022-12-16. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-of-service condition (DOS).