Strix
26.1K

CVE-2012-6435

HIGHCVSS 7.5/10EPSS 41.89%

Last modified

CVE-2012-6435 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur. This situation could cause loss of availability and a disruption of communication with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400. EPSS estimates a 41.89% chance of exploitation in the next 30 days.

Description

When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur. This situation could cause loss of availability and a disruption of communication with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
41.89%

98.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
RockwellautomationControllogix Controllers<= 20
RockwellautomationGuardlogix Controllers<= 20
RockwellautomationMicrologix<= 1100
RockwellautomationMicrologix<= 1400
RockwellautomationSoftlogix Controllers<= 19
Rockwellautomation1756-EnbtAll versions
Rockwellautomation1756-EwebAll versions
Rockwellautomation1768-EnbtAll versions
Rockwellautomation1768-EwebAll versions
Rockwellautomation1794-Aentr Flex I\/O Ethernet\/Ip AdapterAll versions
RockwellautomationCompactlogix<= 18
RockwellautomationCompactlogix Controllers<= 19
RockwellautomationCompactlogix L32e ControllerAll versions
RockwellautomationCompactlogix L35e ControllerAll versions
RockwellautomationControllogix<= 18
RockwellautomationFlexlogix 1788-Enbt AdapterAll versions
RockwellautomationGuardlogix<= 18
RockwellautomationSoftlogix<= 18

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2012-6435?
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur. This situation could cause loss of availability and a disruption of communication with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
How severe is CVE-2012-6435?
CVE-2012-6435 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 41.89% probability of exploitation in the next 30 days.
How do I fix CVE-2012-6435?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-6435?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST