High severity · published Jan 24, 2013
CVE-2012-6436
The device does not properly validate the data being sent to the buffer
7.5
CVSS
27.1%
EPSS
No
On KEV
Description
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the CPU to crash. Successful exploitation of this vulnerability could cause loss of availability and a disruption in communications with other connected devices.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)27.1% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
17
1756-enbt · Rockwellautomation
All versions, or not specified · source: NVD
17
1756-eweb · Rockwellautomation
All versions, or not specified · source: NVD
17
1768-enbt · Rockwellautomation
All versions, or not specified · source: NVD
17
1768-eweb · Rockwellautomation
All versions, or not specified · source: NVD
1F
1794-aentr Flex I/o Ethernet/ip Adapter · Rockwellautomation
All versions, or not specified · source: NVD
CO
Compactlogix · Rockwellautomation
through 18 · source: NVD
CC
Compactlogix Controllers · Rockwellautomation
through 19 · source: NVD
CL
Compactlogix L32e Controller · Rockwellautomation
All versions, or not specified · source: NVD
CL
Compactlogix L35e Controller · Rockwellautomation
All versions, or not specified · source: NVD
CO
Controllogix · Rockwellautomation
through 18 · source: NVD
CC
Controllogix Controllers · Rockwellautomation
through 20 · source: NVD
F1
Flexlogix 1788-enbt Adapter · Rockwellautomation
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6436
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6436
rockwellautomation.custhelp.com
http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102
rockwellautomation.custhelp.com
https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154
rockwellautomation.custhelp.com
https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155
rockwellautomation.custhelp.com
https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03
US Government Resource
http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf
More from 1756-enbt
9.8
CVE-2012-6437
The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or…
7.5
CVE-2012-6438
The device does not properly validate the data being sent to the buffer
7.5
CVE-2012-6435
When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs…
4.8
CVE-2012-6440
The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack
–
CVE-2012-6441
An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port…