CVE-2024-3493 is a high severity improper input validation flaw (CVSS 8.6) in Rockwell Automation ControlLogix 5580, GuardLogix 5580, CompactLogix 5380 and 1756-EN4TR products. A malformed fragmented packet can cause a major nonrecoverable fault. Check Rockwell advisory SD1666 for fixed firmware.
What's affected
The record names Rockwell Automation ControlLogix 5580, GuardLogix 5580, CompactLogix 5380 and the 1756-EN4TR, with firmware 35.011 shown in the product list. The weakness is CWE-20 (improper input validation). The CVSS vector in the record says the attack is reached over the network, with low attack complexity, needing no privileges and no user interaction.
The description says a specific malformed fragmented packet can cause a major nonrecoverable fault. The product then becomes unavailable and needs a manual restart, and the fault could also cause a loss of view or control of connected devices. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
The vendor advisory linked in the record is SD1666. It returned a page not found message when I tried to fetch it, so I could not confirm the fixed firmware versions. Do not guess at them: read the advisory from your Rockwell account or the vendor support site.
How to check if you're exposed
Use your asset management tool or the controller's web page to list each affected model and firmware revision, and compare with the fixed revisions in advisory SD1666.
Map which of these controllers can be reached from networks outside the control zone. The vector in the record is network based with no privileges needed, so reachability decides the risk. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which known vulnerabilities touch the open source packages you ship.
Safeguard's reachability analysis helps with the next question, which is whether the vulnerable code is actually called in your application, so you can order the work sensibly.
What to do now
- Inventory affected Rockwell models and firmware revisions.
- Read advisory SD1666 for fixed firmware and mitigations, and plan the update with the process owner.
- Confirm the controllers are not reachable from the internet or from general business networks.
- Restrict traffic into the control zone to the hosts that need it.
- Document the manual restart steps so operators can recover quickly if a fault occurs.
Why it matters
The weakness is improper input validation. The controller's network stack accepts a packet shape it does not handle safely, and the result is a fault instead of a dropped packet. The impact is availability: an industrial controller that stops can halt a process.
Controllers should never be reachable from the internet, and traffic into the control zone should pass through firewalls. If the vendor's fixed firmware is available for your model, plan its update in a maintenance window with the process owner. The record's KEV flag is false, so CISA's Known Exploited Vulnerabilities catalog did not list it when this record was captured.
Quick check
Is a fix confirmed in this post?
No. The vendor advisory could not be fetched, so the fixed firmware versions are not stated. Read advisory SD1666.
Sources
- NVD record data for CVE-2024-3493
- Vendor advisory linked in the record (returned a not found page when fetched): https://www.rockwellautomation.com/en-us/support/advisory.SD1666.html
Last reviewed: 19 October 2026.
