Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution

Description

Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

Scores

EPSS (exploitation in 30 days)

5.5% · top 7.1% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• CWE-787 Out-of-bounds Write (opens in a new tab)All about CWE-787 and its CVEs

Affected products

• Rockwell Automation · 1756-EN2T Series A, B, C

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN2T Series D

  • affected <=11.003

• Rockwell Automation · 1756-EN2TK Series A, B, C

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN2TXT Series A, B, C

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN2TXT Series D

  • affected <=11.003

• Rockwell Automation · 1756-EN2TP Series A

  • affected <=11.003

• Rockwell Automation · 1756-EN2TPK Series A

  • affected <=11.003

• Rockwell Auotmation · 1756-EN2TPXT Series A

  • affected <=11.003

• Rockwell Automation · 1756-EN2TR Series A, B

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN2TR Series C

  • affected <=11.003

• Rockwell Automation · 1756-EN2TRK Series A, B

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN2TRK Series C

  • affected <=11.003

• Rockwell Automation · 1756-EN2TRXT Series A, B

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN2TRXT Series C

  • affected <=11.003

• Rockwell Automation · 1756-EN2F Series A, B

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN2F Series C

  • affected <=11.003

• Rockwell Automation · 1756-EN2FK Series A, B

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN2FK Series C

  • affected <=11.003

• Rockwell Automation · 1756-EN3TR Series A

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN3TR Series B

  • affected <=11.003

• Rockwell Automation · 1756-EN3TRK Series A

  • affected <=5.008 & 5.028

• Rockwell Automation · 1756-EN3TRK Series B

  • affected <=11.003

What to do

Solution: * Update firmware. Update EN2* ControlLogix communications modules to mitigated firmware. * Properly segment networks. Given a cyber actor would require network connectivity to the communication module to exploit the vulnerability, organizations should ensure ICS/SCADA networks are properly segmented within the process structure as well as from the Internet and other non-essential networks. * Implement detection signatures. Use appended Snort signatures to monitor and detect anomalous Common Industrial Protocol (CIP) packets to Rockwell Automation devices.

References (1)

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2023-3595](https://trackcve.app/badge/CVE-2023-3595.svg)](https://trackcve.app/cve/CVE-2023-3595)

Record last updated 2 Aug 2024, 07:01 UTC.