NVD Vulnerability Detail

CVE-2018-19282

Summary	Rockwell Automation PowerFlex 525 AC Drives 5.001 and earlier allow remote attackers to cause a denial of service by crashing the Common Industrial Protocol (CIP) network stack. The vulnerability allows the attacker to crash the CIP in a way that it does not accept new connections, but keeps the current connections active, which can prevent legitimate users from recovering control.
Publication Date	April 5, 2019, 6:29 a.m.
Registration Date	March 1, 2021, 7:12 p.m.
Last Update	Nov. 21, 2024, 12:57 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:rockwellautomation:powerflex_525_ac_drives_firmware::::::::			5.001
execution environment
1	cpe:2.3:h:rockwellautomation:powerflex_525_ac_drives:-:::::::*

Related information, measures and tools

No	URL	タグ
1	https://applied-risk.com/application/files/4215/5385/2294/Advisory_AR2019004_Rockwell_Powerflex_525_Denial_of_Service.pdf	Third Party Advisory
2	https://applied-risk.com/application/files/4215/5385/2294/Advisory_AR2019004_Rockwell_Powerflex_525_Denial_of_Service.pdf	Third Party Advisory
3	https://ics-cert.us-cert.gov/advisories/ICSA-19-087-01	Third Party Advisory US Government Resource
4	https://ics-cert.us-cert.gov/advisories/ICSA-19-087-01	Third Party Advisory US Government Resource

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-400	リソースの枯渇	https://cwe.mitre.org/data/definitions/400.html

JVN Vulnerability Information

Rockwell Automation PowerFlex 525 AC Drives におけるリソースの枯渇に関する脆弱性

Title	Rockwell Automation PowerFlex 525 AC Drives におけるリソースの枯渇に関する脆弱性
Summary	Rockwell Automation PowerFlex 525 AC Drives には、リソースの枯渇に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	July 30, 2018, midnight
Registration Date	May 14, 2019, 2:41 p.m.
Last Update	May 14, 2019, 2:41 p.m.

Affected System

Rockwell Automation

PowerFlex 525 AC Drives ファームウェア 5.001 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2018-19282	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19282
National Vulnerability Database (NVD)
2	CVE-2018-19282	https://nvd.nist.gov/vuln/detail/CVE-2018-19282

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-400	https://cwe.mitre.org/data/definitions/400.html

ベンダー情報

No	Name	URL
Rockwell Automation
1	PowerFlex 525 AC Drives	https://ab.rockwellautomation.com/Drives/PowerFlex-525

その他

No	Name	URL
ICS-CERT ADVISORY
1	ICSA-19-087-01	https://ics-cert.us-cert.gov/advisories/ICSA-19-087-01
関連文書
2	Rockwell Automation PowerFlex 525 Denial of Service	https://applied-risk.com/application/files/4215/5385/2294/Advisory_AR2019004_Rockwell_Powerflex_525_Denial_of_Service.pdf

Change Log

No	Changed Details	Date of change
1	[2019年05月14日] 掲載	May 14, 2019, 2:41 p.m.