CVE-2012-6440 (GCVE-0-2012-6440)

Vulnerability from cvelistv5 – Published: 2013-01-24 21:00 – Updated: 2025-06-30 22:03
VLAI?
Title
Rockwell Automation ControlLogix PLC Improper Input Validation
Summary
The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
Severity ?
No CVSS data available.
CWE
Assigner
References
Impacted products
Vendor Product Version
Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules Affected: All
Create a notification for this product.
Credits
This vulnerability was discovered by Rockwell Automation engineers as they were investigating other vulnerabilities reported at the Digital Bond S4 2012 Conference.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T21:28:39.932Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "All"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CompactLogix L32E and L35E controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "All"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1788-ENBT FLEXLogix adapter",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "All"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "1794-AENTR FLEX I/O EtherNet/IP adapter",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "All"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ControlLogix, CompactLogix, GuardLogix, and SoftLogix",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "18",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "CompactLogix and SoftLogix controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "19",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ControlLogix and GuardLogix controllers",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "lessThanOrEqual": "20",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "MicroLogix",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "1100"
            },
            {
              "status": "affected",
              "version": "1400"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability was discovered by Rockwell Automation engineers as they were investigating other vulnerabilities reported at the Digital Bond S4 2012 Conference."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\n\n\n\n\n\n\n\n\n\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThe Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product\u2019s Web server to view and alter product configuration and diagnostics information.\u003c/span\u003e\n\n\u003c/p\u003e\u003cp\u003eRockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400\u0026nbsp;\u003cbr\u003e\u003c/p\u003e"
            }
          ],
          "value": "The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product\u2019s Web server to view and alter product configuration and diagnostics information.\n\n\n\nRockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400"
        }
      ],
      "metrics": [
        {
          "cvssV2_0": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.3,
            "confidentialityImpact": "COMPLETE",
            "integrityImpact": "COMPLETE",
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-30T22:03:01.214Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03"
        },
        {
          "url": "https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154"
        },
        {
          "url": "https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155"
        },
        {
          "url": "https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156"
        },
        {
          "url": "http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAccording to Rockwell, any of the above products that become affected by a vulnerability can be reset by rebooting or power cycling the affected product. After the reboot, the affected product may require some reconfiguration.\u003c/p\u003e\u003cp\u003eTo mitigate the vulnerabilities, Rockwell has developed and released security patches on July 18, 2012, to address each of the issues. To download and install the patches please refer to Rockwell\u2019s Advisories at:\u003c/p\u003e\u003cp\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154\u003c/a\u003e\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/aid/470155\u003c/a\u003e\u003cbr\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156\"\u003ehttps://rockwellautomation.custhelp.com/app/answers/detail/aid/470156\u003c/a\u003e\u003c/p\u003e\u003cp\u003eFor more information on security with Rockwell Automation products, please refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102\"\u003eRockwell\u2019s Security Advisory Index\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "According to Rockwell, any of the above products that become affected by a vulnerability can be reset by rebooting or power cycling the affected product. After the reboot, the affected product may require some reconfiguration.\n\nTo mitigate the vulnerabilities, Rockwell has developed and released security patches on July 18, 2012, to address each of the issues. To download and install the patches please refer to Rockwell\u2019s Advisories at:\n\n https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154 \n https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155 \n https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156 \n\nFor more information on security with Rockwell Automation products, please refer to  Rockwell\u2019s Security Advisory Index http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102 ."
        }
      ],
      "source": {
        "advisory": "ICSA-13-011-03",
        "discovery": "INTERNAL"
      },
      "title": "Rockwell Automation ControlLogix PLC Improper Input Validation",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRockwell recommends updating to the newest firmware patches to fix the vulnerabilities, but if not able to do so right away, then Rockwell advises immediately employing the following mitigations for each of the affected products.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\n\n\u003cp\u003eTo mitigate the vulnerability with the Web server password authentication mechanism:\u003c/p\u003e\u003col\u003e\u003cli\u003eUpgrade the MicroLogix 1400 firmware to FRN 12 or higher.\u003c/li\u003e\u003cli\u003eBecause of limitations in the MicroLogix 1100 platform, none of the firmware updates will be able to fix this issue, so users should use the following techniques to help reduce the likelihood of compromise.\u003c/li\u003e\u003cli\u003eWhere possible, disable the Web server and change all default Administrator and Guest passwords.\u003c/li\u003e\u003cli\u003eIf Web server functionality is needed, then Rockwell recommends upgrading the product\u2019s firmware to the most current version to have the newest enhanced protections available such as:\u003col\u003e\u003cli\u003eWhen a controller receives two consecutive invalid authentication requests from an HTTP client, the controller resets the Authentication Counter after 60 minutes.\u003c/li\u003e\u003cli\u003eWhen a controller receives 10 invalid authentication requests from any HTTP client, it will not accept any valid or invalid authentication packets until a 24-hour HTTP Server Lock Timer timeout.\u003c/li\u003e\u003c/ol\u003e\u003c/li\u003e\u003cli\u003eIf Web server functionality is needed, Rockwell also recommends configuring user accounts to have READ only access to the product so those accounts cannot be used to make configuration change\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eIn addition to the above, Rockwell recommends concerned customers remain vigilant and continue to follow security strategies that help reduce risk and enhance overall control system security. Where possible, they suggest you apply multiple recommendations and complement this list with your own best-practices:\u003c/p\u003e\u003col\u003e\u003cli\u003eEmploy layered security and defense-in-depth methods in system design to restrict and control access to individual products and control networks. Refer to \u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://www.ab.com/networks/architectures.html\"\u003ehttp://www.ab.com/networks/architectures.html\u003c/a\u003e for comprehensive information about implementing validated architectures designed to deliver these measures.\u003c/li\u003e\u003cli\u003eRestrict physical and electronic access to automation products, networks, and systems to only those individuals authorized to be in contact with control system equipment.\u003c/li\u003e\u003cli\u003eEmploy firewalls with ingress/egress filtering, intrusion detection/prevention systems, and validate all configurations. Evaluate firewall configurations to ensure other appropriate inbound and outbound traffic is blocked.\u003c/li\u003e\u003cli\u003eUse up-to-date end-point protection software (e.g., antivirus/antimalware software) on all PC-based assets.\u003c/li\u003e\u003cli\u003eMake sure that software and control system device firmware is patched to current releases.\u003c/li\u003e\u003cli\u003ePeriodically change passwords in control system components and infrastructure devices.\u003c/li\u003e\u003cli\u003eWhere applicable, set the controller key-switch/mode-switch to RUN mode.\u003c/li\u003e\u003c/ol\u003e\n\n\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eFor more information on security with Rockwell Automation products, please refer to \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102\"\u003eRockwell\u2019s Security Advisory Index\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\n\n\u003cbr\u003e"
            }
          ],
          "value": "Rockwell recommends updating to the newest firmware patches to fix the vulnerabilities, but if not able to do so right away, then Rockwell advises immediately employing the following mitigations for each of the affected products.\n\n\n\n\n\nTo mitigate the vulnerability with the Web server password authentication mechanism:\n\n  *  Upgrade the MicroLogix 1400 firmware to FRN 12 or higher.\n  *  Because of limitations in the MicroLogix 1100 platform, none of the firmware updates will be able to fix this issue, so users should use the following techniques to help reduce the likelihood of compromise.\n  *  Where possible, disable the Web server and change all default Administrator and Guest passwords.\n  *  If Web server functionality is needed, then Rockwell recommends upgrading the product\u2019s firmware to the most current version to have the newest enhanced protections available such as:  *  When a controller receives two consecutive invalid authentication requests from an HTTP client, the controller resets the Authentication Counter after 60 minutes.\n  *  When a controller receives 10 invalid authentication requests from any HTTP client, it will not accept any valid or invalid authentication packets until a 24-hour HTTP Server Lock Timer timeout.\n\n  *  If Web server functionality is needed, Rockwell also recommends configuring user accounts to have READ only access to the product so those accounts cannot be used to make configuration change\nIn addition to the above, Rockwell recommends concerned customers remain vigilant and continue to follow security strategies that help reduce risk and enhance overall control system security. Where possible, they suggest you apply multiple recommendations and complement this list with your own best-practices:\n\n  *  Employ layered security and defense-in-depth methods in system design to restrict and control access to individual products and control networks. Refer to  http://www.ab.com/networks/architectures.html  for comprehensive information about implementing validated architectures designed to deliver these measures.\n  *  Restrict physical and electronic access to automation products, networks, and systems to only those individuals authorized to be in contact with control system equipment.\n  *  Employ firewalls with ingress/egress filtering, intrusion detection/prevention systems, and validate all configurations. Evaluate firewall configurations to ensure other appropriate inbound and outbound traffic is blocked.\n  *  Use up-to-date end-point protection software (e.g., antivirus/antimalware software) on all PC-based assets.\n  *  Make sure that software and control system device firmware is patched to current releases.\n  *  Periodically change passwords in control system components and infrastructure devices.\n  *  Where applicable, set the controller key-switch/mode-switch to RUN mode.\n\n\n\n\nFor more information on security with Rockwell Automation products, please refer to  Rockwell\u2019s Security Advisory Index http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102 ."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2012-6439",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 allow remote attackers to cause a denial of service (control and communication outage) via a CIP message that modifies the (1) configuration or (2) network parameters."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf",
              "refsource": "MISC",
              "url": "http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2012-6440",
    "datePublished": "2013-01-24T21:00:00.000Z",
    "dateReserved": "2012-12-26T00:00:00.000Z",
    "dateUpdated": "2025-06-30T22:03:01.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rockwellautomation:controllogix_controllers:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"20\", \"matchCriteriaId\": \"37F4D4ED-1915-4155-9F0A-691771AA534B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rockwellautomation:guardlogix_controllers:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"20\", \"matchCriteriaId\": \"A2F8B5EE-C1BA-4CFB-B17F-C59BCDB41503\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rockwellautomation:micrologix:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1100\", \"matchCriteriaId\": \"DE554CCC-0A46-43D4-8D7D-44200BB7D314\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rockwellautomation:micrologix:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"1400\", \"matchCriteriaId\": \"8D3B4218-4483-4FAE-9915-8937F40AED27\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rockwellautomation:softlogix_controllers:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"19\", \"matchCriteriaId\": \"FE7219A5-4759-4143-B89F-869D49CAAFF7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:1756-enbt:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"330E9A05-C869-41B1-BB28-FD2A7C7ED0CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:1756-eweb:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2AD7D5DB-4A49-421A-8C6C-B9E6DA0A499B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:1768-enbt:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD44B55C-BDD7-41CC-91A9-F31ED2FC69E2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:1768-eweb:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C91D5245-DED2-469C-A800-62109F8159C9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:1794-aentr_flex_i\\\\/o_ethernet\\\\/ip_adapter:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0BD25E6B-6AE1-4B8C-A086-F5E152CAAA60\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:compactlogix:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"18\", \"matchCriteriaId\": \"AA199887-E8F7-48EE-B1E0-9EF2E439DACE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:compactlogix_controllers:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"19\", \"matchCriteriaId\": \"A763D845-B091-47A4-8A29-A1CD19C1E4F2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:compactlogix_l32e_controller:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"19B8ED27-2512-4A42-973C-99D300963046\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:compactlogix_l35e_controller:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7EFC590C-01C1-48D1-A5BE-0F70BE7F36B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:controllogix:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"18\", \"matchCriteriaId\": \"4FE24B9B-9F7D-4D8F-A674-F04FC9F9F8BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:flexlogix_1788-enbt_adapter:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"887A3369-548C-42B0-82C5-92CB161D3B7A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:guardlogix:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"18\", \"matchCriteriaId\": \"E98626DD-BC79-473E-B25F-92C9BA12F6DD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:h:rockwellautomation:softlogix:*:*:*:*:*:*:*:*\", \"versionEndIncluding\": \"18\", \"matchCriteriaId\": \"D83AF504-2845-4022-BA8E-52F4FB773EA4\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The web-server password-authentication functionality in Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400 allows man-in-the-middle attackers to conduct replay attacks via HTTP traffic.\"}, {\"lang\": \"es\", \"value\": \"La funcionalidad de autenticaci\\u00f3n web-server en los productos Rockwell Automation EtherNet/IP; m\\u00f3dulos de comunicaci\\u00f3n 1756-ENBT, 1756-EWEB, 1768-ENBT, y 1768-EWEB; controlodares CompactLogix L32E y L35E; adaptador 1788-ENBT FLEXLogix; adaptador 1794-AENTR FLEX I/O EtherNet/IP; ControlLogix 18 y anteriores; CompactLogix 18 y anteriores; GuardLogix 18 y anteriores; SoftLogix 18 y anteriores; controladores CompactLogix 19 y anteriores; controladores SoftLogix 19 y anteriores; controladores ControlLogix 20 y anteriores; controladores GuardLogix 20 y anteriores; MicroLogix 1100 y 1400 permiten ataques man-in-the-middle conducir ataques de repetici\\u00f3n por tr\\u00e1fico HTTP.\"}]",
      "id": "CVE-2012-6440",
      "lastModified": "2024-11-21T01:46:07.900",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:C/I:C/A:C\", \"baseScore\": 9.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 8.6, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2013-01-24T21:55:01.697",
      "references": "[{\"url\": \"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf\", \"source\": \"ics-cert@hq.dhs.gov\", \"tags\": [\"US Government Resource\"]}, {\"url\": \"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"US Government Resource\"]}]",
      "sourceIdentifier": "ics-cert@hq.dhs.gov",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-287\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2012-6440\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2013-01-24T21:55:01.697\",\"lastModified\":\"2025-06-30T22:15:29.253\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product\u2019s Web server to view and alter product configuration and diagnostics information.\\n\\n\\n\\nRockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400\"},{\"lang\":\"es\",\"value\":\"La funcionalidad de autenticaci\u00f3n web-server en los productos Rockwell Automation EtherNet/IP; m\u00f3dulos de comunicaci\u00f3n 1756-ENBT, 1756-EWEB, 1768-ENBT, y 1768-EWEB; controlodares CompactLogix L32E y L35E; adaptador 1788-ENBT FLEXLogix; adaptador 1794-AENTR FLEX I/O EtherNet/IP; ControlLogix 18 y anteriores; CompactLogix 18 y anteriores; GuardLogix 18 y anteriores; SoftLogix 18 y anteriores; controladores CompactLogix 19 y anteriores; controladores SoftLogix 19 y anteriores; controladores ControlLogix 20 y anteriores; controladores GuardLogix 20 y anteriores; MicroLogix 1100 y 1400 permiten ataques man-in-the-middle conducir ataques de repetici\u00f3n por tr\u00e1fico HTTP.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:C/I:C/A:C\",\"baseScore\":9.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rockwellautomation:controllogix_controllers:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"20\",\"matchCriteriaId\":\"37F4D4ED-1915-4155-9F0A-691771AA534B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rockwellautomation:guardlogix_controllers:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"20\",\"matchCriteriaId\":\"A2F8B5EE-C1BA-4CFB-B17F-C59BCDB41503\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rockwellautomation:micrologix:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1100\",\"matchCriteriaId\":\"DE554CCC-0A46-43D4-8D7D-44200BB7D314\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rockwellautomation:micrologix:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"1400\",\"matchCriteriaId\":\"8D3B4218-4483-4FAE-9915-8937F40AED27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rockwellautomation:softlogix_controllers:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"19\",\"matchCriteriaId\":\"FE7219A5-4759-4143-B89F-869D49CAAFF7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:1756-enbt:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"330E9A05-C869-41B1-BB28-FD2A7C7ED0CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:1756-eweb:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AD7D5DB-4A49-421A-8C6C-B9E6DA0A499B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:1768-enbt:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD44B55C-BDD7-41CC-91A9-F31ED2FC69E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:1768-eweb:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C91D5245-DED2-469C-A800-62109F8159C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:1794-aentr_flex_i\\\\/o_ethernet\\\\/ip_adapter:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0BD25E6B-6AE1-4B8C-A086-F5E152CAAA60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:compactlogix:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"18\",\"matchCriteriaId\":\"AA199887-E8F7-48EE-B1E0-9EF2E439DACE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:compactlogix_controllers:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"19\",\"matchCriteriaId\":\"A763D845-B091-47A4-8A29-A1CD19C1E4F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:compactlogix_l32e_controller:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"19B8ED27-2512-4A42-973C-99D300963046\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:compactlogix_l35e_controller:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EFC590C-01C1-48D1-A5BE-0F70BE7F36B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:controllogix:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"18\",\"matchCriteriaId\":\"4FE24B9B-9F7D-4D8F-A674-F04FC9F9F8BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:flexlogix_1788-enbt_adapter:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"887A3369-548C-42B0-82C5-92CB161D3B7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:guardlogix:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"18\",\"matchCriteriaId\":\"E98626DD-BC79-473E-B25F-92C9BA12F6DD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:h:rockwellautomation:softlogix:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"18\",\"matchCriteriaId\":\"D83AF504-2845-4022-BA8E-52F4FB773EA4\"}]}]}],\"references\":[{\"url\":\"http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03\",\"source\":\"ics-cert@hq.dhs.gov\"},{\"url\":\"http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"US Government Resource\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.