CVE-2023-3595 Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution
Remote attackers can execute code and manipulate data on Rockwell ControlLogix communication modules via crafted CIP messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3595?
CVE-2023-3595 is a critical memory corruption vulnerability in Rockwell Auotmation 1756-EN2F Series A, B, published on 12 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.
Weakness: CWE-787
Which versions are affected by CVE-2023-3595?
It affects 12 products.
Products include Rockwellautomation 1756-En2f Series a Firmware, Rockwellautomation 1756-En2f Series B Firmware, Rockwellautomation 1756-En2f Series C Firmware, Rockwellautomation 1756-En2t Series a Firmware, Rockwellautomation 1756-En2t Series B Firmware, Rockwellautomation 1756-En2t Series C Firmware and 6 more.
How do I fix CVE-2023-3595?
No fix has been published for CVE-2023-3595 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-3595 being exploited?
There is no known exploitation of CVE-2023-3595 in the wild and no public exploit code.
Other vulnerabilities in Rockwell Auotmation 1756-EN2F Series A, B
Sources
Also known as GHSA-qvv4-3g8f-rgjx.