CVE-2012-6438: Rockwell Automation ControlLogix PLC Improper Input Validation
Buffer overflow in Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 allows remote attackers to cause a denial of service (NIC crash and communication outage) via a malformed CIP packet.
Other sources
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the NIC to crash. Successful exploitation of this vulnerability could cause loss of availability and a disruption in communications with other connected devices.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2012-6438?
CVE-2012-6438 has a high severity status due to its potential to cause a buffer overflow in critical Rockwell Automation devices.
How do I fix CVE-2012-6438?
To fix CVE-2012-6438, you should apply the latest firmware updates provided by Rockwell Automation for the affected devices.
Which devices are affected by CVE-2012-6438?
CVE-2012-6438 affects various Rockwell Automation devices, including ControlLogix, CompactLogix, and MicroLogix controllers as well as several communication modules.
What are the risks associated with CVE-2012-6438?
The risks associated with CVE-2012-6438 include unauthorized access and the potential for remote code execution on the affected devices.
Is CVE-2012-6438 actively exploited?
As of the last reports, there is no confirmed active exploitation of CVE-2012-6438, but its high severity warrants immediate attention.