Strix
26.1K

CVE-2012-6440

MEDIUMCVSS 4.8/10EPSS 8.12%

Last modified

CVE-2012-6440 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400. EPSS estimates a 8.12% chance of exploitation in the next 30 days.

Description

The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

Metrics

CVSS 3.1
4.8/10

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Probability
8.12%

94.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
RockwellautomationControllogix Controllers<= 20
RockwellautomationGuardlogix Controllers<= 20
RockwellautomationMicrologix<= 1100
RockwellautomationMicrologix<= 1400
RockwellautomationSoftlogix Controllers<= 19
Rockwellautomation1756-EnbtAll versions
Rockwellautomation1756-EwebAll versions
Rockwellautomation1768-EnbtAll versions
Rockwellautomation1768-EwebAll versions
Rockwellautomation1794-Aentr Flex I\/O Ethernet\/Ip AdapterAll versions
RockwellautomationCompactlogix<= 18
RockwellautomationCompactlogix Controllers<= 19
RockwellautomationCompactlogix L32e ControllerAll versions
RockwellautomationCompactlogix L35e ControllerAll versions
RockwellautomationControllogix<= 18
RockwellautomationFlexlogix 1788-Enbt AdapterAll versions
RockwellautomationGuardlogix<= 18
RockwellautomationSoftlogix<= 18

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2012-6440?
The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
How severe is CVE-2012-6440?
CVE-2012-6440 has a CVSS score of 4.8/10 (MEDIUM severity). The EPSS model estimates a 8.12% probability of exploitation in the next 30 days.
How do I fix CVE-2012-6440?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2012-6440?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST