CVE-2023-3596 Rockwell Automation Allen-Bradley ControlLogix Communication Modules vulnerable to Denial of Service

2023-07-1212:51:19

CWE-787

Rockwell

www.cve.org

rockwell automation

1756-en4*

ethernet/ip

communication module

dos

vulnerability

cip messages

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

21.9%

JSON

Where this vulnerability exists in the Rockwell Automation 1756-EN4* Ethernet/IP communication products, it could allow a malicious user to cause a denial of service by asserting the target system through maliciously crafted CIP messages.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "1756-EN4TR Series A",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "<=5.001"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "1756-EN4TRK Series A",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "<=5.001"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "1756-EN4TRXT Series A\t",
    "vendor": "Rockwell Automation",
    "versions": [
      {
        "status": "affected",
        "version": "<=5.001"
      }
    ]
  }
]