CVE-2020-6998 — MEDIUM (5.8)

Q: How severe is CVE-2020-6998?

CVE-2020-6998 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2020-6998?

Check the references section above for vendor advisories and patch information. Affected products include: Rockwellautomation Armor Compact Guardlogix 5370 Firmware, Rockwellautomation Armor Compact Guardlogix 5370, Rockwellautomation Compact Guardlogix 5370 Firmware, Rockwellautomation Compact Guardlogix 5370, Rockwellautomation Compactlogix 5370 L1 Firmware.

Vulnerability Description

The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creating an infinite loop. This may allow an attacker to send specially crafted CIP packet requests to a controller, which may cause denial-of-service conditions in communications with other products.

CVSS Score

5.8

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Rockwellautomation	Armor Compact Guardlogix 5370 Firmware	<= 33
Rockwellautomation	Armor Compact Guardlogix 5370	-
Rockwellautomation	Compact Guardlogix 5370 Firmware	<= 33
Rockwellautomation	Compact Guardlogix 5370	-
Rockwellautomation	Compactlogix 5370 L1 Firmware	<= 33
Rockwellautomation	Compactlogix 5370 L1	-
Rockwellautomation	Compactlogix 5370 L2 Firmware	<= 33
Rockwellautomation	Compactlogix 5370 L2	-
Rockwellautomation	Compactlogix 5370 L3 Firmware	<= 33
Rockwellautomation	Compactlogix 5370 L3	-
Rockwellautomation	Controllogix 5570 Firmware	<= 33
Rockwellautomation	Controllogix 5570	-
Rockwellautomation	Guardlogix 5560 Firmware	<= 33
Rockwellautomation	Guardlogix 5560	-
Rockwellautomation	Guardlogix 5570 Firmware	<= 33
Rockwellautomation	Guardlogix 5570	-
Rockwellautomation	Guardlogix 5580 Firmware	<= 33
Rockwellautomation	Guardlogix 5580	-

Related Weaknesses (CWE)

CWE-20

References

https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398Permissions RequiredVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-02Third Party AdvisoryUS Government Resource
https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1130398Permissions RequiredVendor Advisory
https://www.cisa.gov/uscert/ics/advisories/icsa-21-061-02Third Party AdvisoryUS Government Resource

FAQ

What is CVE-2020-6998?

CVE-2020-6998 is a vulnerability with a CVSS score of 5.8 (MEDIUM). The connection establishment algorithm found in Rockwell Automation CompactLogix 5370 and ControlLogix 5570 versions 33 and prior does not sufficiently manage its control flow during execution, creati...

How severe is CVE-2020-6998?

CVE-2020-6998 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-6998?

Check the references section above for vendor advisories and patch information. Affected products include: Rockwellautomation Armor Compact Guardlogix 5370 Firmware, Rockwellautomation Armor Compact Guardlogix 5370, Rockwellautomation Compact Guardlogix 5370 Firmware, Rockwellautomation Compact Guardlogix 5370, Rockwellautomation Compactlogix 5370 L1 Firmware.