CVE-2023-3595
Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jul 12, 2023
- Updated
- Aug 2, 2024
- Reserved
- Jul 10, 2023
Description
Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Rockwell |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
1756-EN2T Series A, B, CRockwell Automation |
|
1756-EN2T Series DRockwell Automation |
|
1756-EN2TK Series A, B, CRockwell Automation |
|
1756-EN2TXT Series A, B, CRockwell Automation |
|
1756-EN2TXT Series DRockwell Automation |
|
1756-EN2TP Series ARockwell Automation |
|
1756-EN2TPK Series ARockwell Automation |
|
1756-EN2TPXT Series ARockwell Auotmation |
|
1756-EN2TR Series A, BRockwell Automation |
|
1756-EN2TR Series CRockwell Automation |
|
1756-EN2TRK Series A, BRockwell Automation |
|
1756-EN2TRK Series CRockwell Automation |
|
1756-EN2TRXT Series A, BRockwell Automation |
|
1756-EN2TRXT Series CRockwell Automation |
|
1756-EN2F Series A, BRockwell Automation |
|
1756-EN2F Series CRockwell Automation |
|
1756-EN2FK Series A, BRockwell Automation |
|
1756-EN2FK Series CRockwell Automation |
|
1756-EN3TR Series ARockwell Automation |
|
1756-EN3TR Series BRockwell Automation |
|
1756-EN3TRK Series ARockwell Automation |
|
1756-EN3TRK Series BRockwell Automation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.