CVE-2024-6207 is a high severity denial of service in Rockwell Automation ControlLogix 5580 and related controllers, scored 7.5. An invalid CIP request can push the device into a major nonrecoverable fault. Rockwell lists corrected firmware in advisory SD1707, so move to the revision for your product line.
What's affected
Rockwell's advisory SD1707 lists these products, with the first affected firmware and the corrected revisions:
- ControlLogix 5580, first known in V28.011
- ControlLogix 5580 Process, first known in V33.011
- GuardLogix 5580, first known in V31.011
- CompactLogix 5380, first known in V28.011
- Compact GuardLogix 5380 SIL 2, first known in V31.011
- Compact GuardLogix 5380 SIL 3, first known in V32.013
- CompactLogix 5480, first known in V32.011
- FactoryTalk Logix Echo, first known in V33.011
The corrected revisions are V33.017, V34.014, V35.013 and V36.011 and later. FactoryTalk Logix Echo is corrected from V34.014. The NVD record only names the ControlLogix 5580 family in its product list, so use the advisory table for the full set.
Scores differ by scoring version, not by source. The advisory gives CVSS v3.1 7.5 and v4.0 8.7. The record carries the v3.1 score, which maps to High. The weakness is CWE-20, improper input validation. Rockwell marks the flaw as not in the KEV catalog, and the record agrees.
How to check if you're exposed
Read the firmware revision from the controller in Studio 5000 Logix Designer, or from the controller properties page. Compare it with the corrected revision for the major version you run. If you are on the V35 line, for example, the corrected revision is V35.013.
Also look at network reachability. The record's description says exploitation needs the attacker to chain this issue with CVE-2021-22681 and send a specially crafted CIP message. That makes it important to know which hosts can speak CIP to the controller at all. Check firewall rules and any routed paths from the business network into the control network.
What to do now
- Identify every controller in the affected families and record its firmware revision.
- Plan a firmware update to the corrected revision for your major version. Controller updates need a maintenance window, because recovery from a fault needs a program download.
- Confirm that CVE-2021-22681 is also addressed, since the advisory ties the two together. Rockwell's own advisory for it is the place to check.
- Restrict CIP traffic so that only engineering workstations and known peers can reach the controllers.
- Follow Rockwell's security best practices referenced in the advisory. The advisory lists no workaround, so patching is the real control.
Why it matters
The advisory says an invalid CIP request causes a major nonrecoverable fault. In plain terms the controller stops running its logic and stays stopped. The advisory notes that recovering the controllers needs a program download, and that this ends any process the controller is running. For a plant that means a halt until someone with the right project file restores the device.
The class of weakness is input validation. The controller accepts a message it should have rejected and fails in a way it cannot recover from by itself. Availability is the only impact scored, but in an industrial setting availability is often the property that matters most.
Quick check
Is this one exploited in the wild?
Rockwell lists it as not in the Known Exploited Vulnerabilities database, and the record has the KEV flag set to false.
Can I work around it without updating?
The advisory states there is no workaround. It points to general security best practices, such as limiting who can send CIP traffic to the controllers.
Sources
- Rockwell Automation advisory SD1707
- NVD record for CVE-2024-6207, as held in the batch record file
Last reviewed: 19 October 2026.
