What’s Vulnerable › Vulnerabilities

CVE-2023-3595: Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-07-12 · updated 2026-06-17
• Weakness: CWE-787

Description

Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

Affected products

• Rockwellautomation 1756-En2F Series A Firmware: all versions
• Rockwellautomation 1756-En2F Series B Firmware: all versions
• Rockwellautomation 1756-En2F Series C Firmware: all versions
• Rockwellautomation 1756-En2T Series A Firmware: all versions
• Rockwellautomation 1756-En2T Series B Firmware: all versions
• Rockwellautomation 1756-En2T Series C Firmware: all versions
• Rockwellautomation 1756-En2T Series D Firmware: all versions
• Rockwellautomation 1756-En2Tr Series A Firmware: all versions
• Rockwellautomation 1756-En2Tr Series B Firmware: all versions
• Rockwellautomation 1756-En2Tr Series C Firmware: all versions
• Rockwellautomation 1756-En3Tr Series A Firmware: all versions
• Rockwellautomation 1756-En3Tr Series B Firmware: all versions

References

• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010

Get alerted when CVE-2023-3595 or the next vulnerability affects your stack