Critical ICSA-13-011-03 8 CVEs

Rockwell Automation ControlLogix PLC Vulnerabilities

Published Oct 15, 2013 · Updated Jun 6, 2025 · Revision 2

Vendor: Rockwell Automation Product: 1756-ENBT Product: 1756-EWEB Product: 1768-ENBT Product: 1768-EWEB Product: 1788-ENBT FLEXLogix adapter Product: 1794-AENTR FLEX I/O EtherNet/IP adapter Product: CompactLogix Product: CompactLogix and SoftLogix controllers Product: CompactLogix L32E and L35E controllers Product: ControlLogix Product: ControlLogix and GuardLogix controllers Product: EtherNet/IP products that conform to the CIP and EtherNet/IP specifications Product: GuardLogix Product: MicroLogix 1100 Product: MicroLogix 1400 Product: SoftLogix

Vulnerabilities 8

Critical 9.8

CVE-2012-6437 EPSS 11%

Rockwell Automation ControlLogix PLC Improper Authentication

The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image. Successful exploitation of this vulnerability could cause los…

Rockwell Automation MicroLogix 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules 1788-ENBT FLEXLogix adapter ICS / OT

Jan 24, 2013
High 8.5

CVE-2012-6439 EPSS 23%

Rockwell Automation ControlLogix PLC Improper Access Control

When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that changes the product’s configuration and network parameters, a DoS condition can occur. This…

Rockwell Automation 1794-AENTR FLEX I/O EtherNet/IP adapter CompactLogix and SoftLogix controllers MicroLogix ICS / OT

Jan 24, 2013
High 7.5

CVE-2012-6435 EPSS 43%

Rockwell Automation ControlLogix PLC Improper Access Control

When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur. This si…

Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and SoftLogix ControlLogix and GuardLogix controllers CompactLogix L32E and L35E controllers ICS / OT

Jan 24, 2013
High 7.5

CVE-2012-6436 EPSS 35%

Rockwell Automation ControlLogix PLC Improper Input Validation

The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the CPU to crash. Successful ex…

Rockwell Automation 1788-ENBT FLEXLogix adapter ControlLogix, CompactLogix, GuardLogix, and SoftLogix ControlLogix and GuardLogix controllers ICS / OT

Jan 24, 2013
High 7.5

CVE-2012-6438 EPSS 36%

Rockwell Automation ControlLogix PLC Improper Input Validation

The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the NIC to crash. Successful ex…

Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules 1788-ENBT FLEXLogix adapter ControlLogix, CompactLogix, GuardLogix, and SoftLogix ICS / OT

Jan 24, 2013
High 7.5

CVE-2012-6442 EPSS 35%

Rockwell Automation ControlLogix PLC Improper Access Control

When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the product to reset, a DoS can occur. This situation could cause loss of availab…

Rockwell Automation CompactLogix L32E and L35E controllers 1794-AENTR FLEX I/O EtherNet/IP adapter CompactLogix and SoftLogix controllers ICS / OT

Jan 24, 2013
Medium 5.0

CVE-2012-6441 EPSS 57%

Rockwell Automation ControlLogix PLC Information Exposure

An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confident…

Rockwell Automation ControlLogix and GuardLogix controllers CompactLogix L32E and L35E controllers 1794-AENTR FLEX I/O EtherNet/IP adapter ICS / OT

Jan 24, 2013
Medium 4.8

CVE-2012-6440

Rockwell Automation ControlLogix PLC Improper Input Validation

The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration a…

Rockwell Automation CompactLogix and SoftLogix controllers MicroLogix 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules ICS / OT

Jan 24, 2013

Revision history

2025-06-06 #2
Advisory converted into a CSAF
2013-10-15 #1
Initial Publication

References

ICS Advisory ICSA-13-011-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf
Recommended Practices
https://www.cisa.gov/uscert/ncas/tips/ST04-014