CVE-2012-6441 Rockwell Automation ControlLogix PLC Information Exposure

Medium 5.0 Published 24 Jan 2013 Updated 30 Jun 2025

An attacker can send crafted CIP packets to Rockwell PLCs to expose confidential information without authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2012-6441?

CVE-2012-6441 is a medium-severity vulnerability in Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules, published on 24 Jan 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confidentiality.

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

Weakness: CWE-200

Which versions are affected by CVE-2012-6441?

It affects 17 products.

Products include Rockwellautomation 1756-Enbt, Rockwellautomation 1756-Eweb, Rockwellautomation 1768-Enbt, Rockwellautomation 1768-Eweb, Rockwellautomation 1794-Aentr Flex I\/O Ethernet\/Ip Adapter, Rockwellautomation Compactlogix and 11 more.

How do I fix CVE-2012-6441?

No fix has been published for CVE-2012-6441 yet. Limit exposure of the affected software until one is available.

Is CVE-2012-6441 being exploited?

There is no known exploitation of CVE-2012-6441 in the wild and no public exploit code.

Sources

Also known as GHSA-qwf3-gf6f-rrw8.