CVE-2012-6439 Rockwell Automation ControlLogix PLC Improper Access Control

High 8.5 Published 24 Jan 2013 Updated 30 Jun 2025

Unauthorized remote attackers can send crafted CIP messages to Rockwell PLCs to cause denial of service and disrupt communication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2012-6439?

CVE-2012-6439 is a high-severity missing authorization vulnerability in Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules, published on 24 Jan 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that changes the product’s configuration and network parameters, a DoS condition can occur. This situation could cause loss of availability and a disruption of communication with other connected devices.

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

Weakness: CWE-284

Which versions are affected by CVE-2012-6439?

It affects 17 products.

Products include Rockwellautomation 1756-Enbt, Rockwellautomation 1756-Eweb, Rockwellautomation 1768-Enbt, Rockwellautomation 1768-Eweb, Rockwellautomation 1794-Aentr Flex I\/O Ethernet\/Ip Adapter, Rockwellautomation Compactlogix and 11 more.

How do I fix CVE-2012-6439?

No fix has been published for CVE-2012-6439 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2012-6439 being exploited?

There is no known exploitation of CVE-2012-6439 in the wild and no public exploit code.

Sources

Also known as GHSA-7q92-phh3-9wp8.