CVE-2012-6440 Rockwell Automation ControlLogix PLC Improper Input Validation

Critical 9.3 Published 24 Jan 2013 Updated 3 Jun 2026

Attackers can bypass web server authentication via MitM or replay attacks to view and alter PLC configuration and diagnostics.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2012-6440?

CVE-2012-6440 is a critical authentication bypass vulnerability in Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules, published on 24 Jan 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information.

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

Weakness: CWE-287

Which versions are affected by CVE-2012-6440?

It affects 17 products.

Products include Rockwellautomation 1756-Enbt, Rockwellautomation 1756-Eweb, Rockwellautomation 1768-Enbt, Rockwellautomation 1768-Eweb, Rockwellautomation 1794-Aentr Flex I\/O Ethernet\/Ip Adapter, Rockwellautomation Compactlogix and 11 more.

How do I fix CVE-2012-6440?

No fix has been published for CVE-2012-6440 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2012-6440 being exploited?

There is no known exploitation of CVE-2012-6440 in the wild and no public exploit code.

Sources

Also known as GHSA-c3p8-qp2x-9xxf.