CVE-2012-6442 Rockwell Automation ControlLogix PLC Improper Access Control
An unauthorized remote attacker can send a valid CIP message to reset Rockwell Automation PLCs, causing a denial of service and communication disruption.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-6442?
CVE-2012-6442 is a high-severity missing authorization vulnerability in Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules, published on 24 Jan 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the product to reset, a DoS can occur. This situation could cause loss of availability and a disruption of communication with other connected devices.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
Which versions are affected by CVE-2012-6442?
It affects 12 products.
Products include Rockwellautomation Compactlogix Controllers Firmware, Rockwellautomation Compactlogix Firmware, Rockwellautomation Controllogix Controllers Firmware, Rockwellautomation Controllogix Firmware, Rockwellautomation Ethernet\/Ip Firmware, Rockwellautomation Flex I\/O Ethernet\/Ip Firmware and 6 more.
How do I fix CVE-2012-6442?
No fix has been published for CVE-2012-6442 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2012-6442 being exploited?
There is no known exploitation of CVE-2012-6442 in the wild and no public exploit code.
Sources
Also known as GHSA-5v56-2w57-vj72.