Skip to content
Fencer Vulns
critical 9.8

CVE-2023-3595 json

Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution

published 2023-07-12 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-44245

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
5.5%
EPSS 5.5% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-193-01 updated cvss 9.8

Rockwell Automation Select Communication Modules

  • Rockwell Automation 1756-EN2F Series A <= 5.008, <= 5.028 Rockwell Automation 1756-EN2F Series B <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2F Series C <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2FK Series A <= 5.008, <= 5.028 Rockwell Automation 1756-EN2FK Series B <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2FK Series C <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2T Series A <= 5.008, <= 5.028 Rockwell Automation 1756-EN2T Series B <= 5.008, <= 5.028 Rockwell Automation 1756-EN2T Series C <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2T Series D <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2TK Series A <= 5.008, <= 5.028 Rockwell Automation 1756-EN2TK Series B <= 5.008, <= 5.028 Rockwell Automation 1756-EN2TK Series C <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2TK Series D <= 11.003 Rockwell Automation 1756-EN2TP Series A <= 11.003 Rockwell Automation 1756-EN2TPK Series A <= 11.003 Rockwell Automation 1756-EN2TPXT Series A <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
show 13 more
  • Rockwell Automation 1756-EN2TR Series A <= 5.008, <= 5.028 Rockwell Automation 1756-EN2TR Series B <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2TR Series C <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2TRK Series A <= 5.008, <= 5.028 Rockwell Automation 1756-EN2TRK Series B <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2TRK Series C <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2TRXT Series A <= 5.008, <= 5.028 Rockwell Automation 1756-EN2TRXT Series B <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2TRXT Series C <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2TXT Series A <= 5.008, <= 5.028 Rockwell Automation 1756-EN2TXT Series B <= 5.008, <= 5.028 Rockwell Automation 1756-EN2TXT Series C <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN2TXT Series D <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN3TR Series A <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN3TR Series B <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN3TRK Series A <= 5.008, <= 5.028
    affected: fixed in 5.029, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN3TRK Series B <= 11.003
    affected: fixed in 11.004, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com
  • Rockwell Automation 1756-EN4TR Series A <= 5.001 Rockwell Automation 1756-EN4TRK Series A <= 5.001 Rockwell Automation 1756-EN4TRXT Series A <= 5.001
    affected: fixed in 5.002, mitigation “Organizations should take the following actions to further secure ControlLogix communications modules from exploitation:” rockwellautomation.custhelp.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

5.53% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Rockwell Automation 1756-EN2T Series A, B, C
  • Rockwell Automation 1756-EN2T Series D
  • Rockwell Automation 1756-EN2TK Series A, B, C
  • Rockwell Automation 1756-EN2TXT Series A, B, C
  • Rockwell Automation 1756-EN2TXT Series D
  • Rockwell Automation 1756-EN2TP Series A
  • Rockwell Automation 1756-EN2TPK Series A
  • Rockwell Auotmation 1756-EN2TPXT Series A
  • Rockwell Automation 1756-EN2TR Series A, B
  • Rockwell Automation 1756-EN2TR Series C
  • Rockwell Automation 1756-EN2TRK Series A, B
  • Rockwell Automation 1756-EN2TRK Series C
  • Rockwell Automation 1756-EN2TRXT Series A, B
  • Rockwell Automation 1756-EN2TRXT Series C
  • Rockwell Automation 1756-EN2F Series A, B
  • Rockwell Automation 1756-EN2F Series C
  • Rockwell Automation 1756-EN2FK Series A, B
  • Rockwell Automation 1756-EN2FK Series C
  • Rockwell Automation 1756-EN3TR Series A
  • Rockwell Automation 1756-EN3TR Series B
  • Rockwell Automation 1756-EN3TRK Series A
  • Rockwell Automation 1756-EN3TRK Series B

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.