CVE-2012-6437 Rockwell Automation ControlLogix PLC Improper Authentication

Critical 10.0 Published 24 Jan 2013 Updated 3 Jun 2026

Remote attackers can upload firmware to Rockwell Automation PLCs without authentication, compromising availability, integrity, and confidentiality.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2012-6437?

CVE-2012-6437 is a critical authentication bypass vulnerability in Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules, published on 24 Jan 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image. Successful exploitation of this vulnerability could cause loss of availability, integrity, and confidentiality and a disruption in communications with other connected devices.

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

Weakness: CWE-287

Which versions are affected by CVE-2012-6437?

It affects 17 products.

Products include Rockwellautomation 1756-Enbt, Rockwellautomation 1756-Eweb, Rockwellautomation 1768-Enbt, Rockwellautomation 1768-Eweb, Rockwellautomation 1794-Aentr Flex I\/O Ethernet\/Ip Adapter, Rockwellautomation Compactlogix and 11 more.

How do I fix CVE-2012-6437?

No fix has been published for CVE-2012-6437 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2012-6437 being exploited?

There is no known exploitation of CVE-2012-6437 in the wild and no public exploit code.

Sources

Also known as GHSA-r6pv-mqwg-xq5g.