CVE-2023-3595: Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution
Where this vulnerability exists in the Rockwell Automation 1756 EN2 and 1756 EN3 ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Properly segment ICS/SCADA networks within the process structure and from the Internet and other non-essential networks to ensure a cyber actor would require network connectivity to the communication module to exploit the vulnerability.
- Compensating control
Implement detection signatures by using appended Snort signatures to monitor and detect anomalous Common Industrial Protocol (CIP) packets to Rockwell Automation devices.
Event History
Frequently Asked Questions
What is CVE-2023-3595?
CVE-2023-3595 is a vulnerability that exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products.
How severe is CVE-2023-3595?
CVE-2023-3595 is classified as critical with a severity value of 9.8.
How does CVE-2023-3595 allow remote code execution?
CVE-2023-3595 allows remote code execution through maliciously crafted CIP messages.
Which Rockwell Automation products are affected by CVE-2023-3595?
CVE-2023-3595 affects the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products.
How can I fix CVE-2023-3595?
To fix CVE-2023-3595, it is recommended to apply the necessary patches or updates provided by Rockwell Automation.