CVE-2024-6242

Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices

State: Published
Severity: 7.3 High
Published: Aug 1, 2024
Updated: Sep 25, 2025
Reserved: Jun 21, 2024

Description

A vulnerability exists in Rockwell Automation affected products that allows a threat actor to bypass the Trusted® Slot feature in a ControlLogix® controller. If exploited on any affected module in a 1756 chassis, a threat actor could potentially execute CIP commands that modify user projects and/or device configuration on a Logix controller in the chassis.

Scores

CVSS	Score	Vector	Source
4.0	7.3 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H	Rockwell

Weaknesses

CWE-420 Unprotected Alternate Channel

Affected Products

Product	Versions
ControlLogix® 5580 (1756-L8z)Rockwell Automation	V28Affected
GuardLogix® 5580 (1756-L8zS)Rockwell Automation	V31Affected
1756-EN4TRRockwell Automation	V2Affected
1756-EN2TRockwell Automation	v5.007(unsigned)/v5.027(signed)Affected
1756-EN2FRockwell Automation	v5.007(unsigned)/v5.027(signed)Affected
1756-EN2TRRockwell Automation	v5.007(unsigned)/v5.027(signed)Affected
1756-EN3TRRockwell Automation	v5.007(unsigned)/v5.027(signed)Affected
1756-EN2TRockwell Automation	1756-EN2T/D: V10.006Affected
1756-EN2FRockwell Automation	1756-EN2F/C: V10.009Affected
1756-EN2TRRockwell Automation	1756-EN2TR/C: V10.007Affected
1756-EN3TRRockwell Automation	1756-EN3TR/B: V10.007Affected
1756-EN2TPRockwell Automation	1756-EN2TP/A: V10.020Affected

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1682.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.