Rockwell Automation Micro850/870 Uncontrolled Resource Consumption (CVE-2024-7567)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505888);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/30");

  script_cve_id("CVE-2024-7567");
  script_xref(name:"ICSA", value:"24-226-07");

  script_name(english:"Rockwell Automation Micro850/870 Uncontrolled Resource Consumption (CVE-2024-7567)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A denial-of-service vulnerability exists via the CIP/Modbus port in
Micro850/870. If exploited, the CIP/Modbus communication may be
disrupted for a short duration.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1684.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?76e8b1e7");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-226-07");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Rockwell Automation recommends that users update to version v22.011.

Rockwell Automation encourages users of the affected software to apply security best practices, if possible.

- For information on how to mitigate security risks on industrial automation control systems, we encourage users to
implement Rockwell Automation suggested security best practices to minimize the risk of the vulnerability.

For more information see the Rockwell Automation Security Advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-7567");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(400);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/08/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/08/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro850_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:micro870_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:micro850_firmware" :
        {"versionEndExcluding" : "22.011", "family" : "Micro850"},
    "cpe:/o:rockwellautomation:micro870_firmware" :
        {"versionEndExcluding" : "22.011", "family" : "Micro870"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);