10.0crit
CVE-2016-9343in critical feed
An issue was discovered in Rockwell Automation Logix5000 Programmable Automation Controller FRN 16.00 through 21.00 (excluding all firmware…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
10.0
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
10.5%
percentile 96%
Public exploits
0
none known
Summary
An issue was discovered in Rockwell Automation Logix5000 Programmable Automation Controller FRN 16.00 through 21.00 (excluding all firmware versions prior to FRN 16.00, which are not affected). By sending malformed common industrial protocol (CIP) packet, an attacker may be able to overflow a stack-based buffer and execute code on the controller or initiate a nonrecoverable fault resulting in a denial of service.
Exploit prediction (EPSS)
10.49% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 10.0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a Rockwell Automation Logix5000 Programmable Automation Controller FRN 16.00 through 21.00
Classification
- Weakness
- CWE-787 Out-of-bounds Write
References
- ics-cert.us-cert.gov /advisories/ICSA-16-343-05 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/95304 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2016-9343
- NVD: CVE-2016-9343
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.