Rockwell Automation issues advisory for multiple vulnerabilities, including a critical flaw that could lead to disruption or destruction of critical infrastructure processes.

CVE-2023-3595, CVE-2023-3596: Rockwell Automation ControlLogix Vulnerabilities Disclosed

Identifying vulnerable systems in your industrial environment can be complex. Use the wrong tool and it will overlook affected devices. Find out how Tenable OT Security is designed to give you in-depth asset visibility to address these new vulnerabilities without disrupting productivity.

Finding Rockwell Automation Allen-Bradley Communication Modules Affected by CVE-2023-3595 and CVE-2023-3596 in OT Environments

Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

This vulnerability affects Rockwell ControlLogix devices used in critical infrastructure. Patching and mitigations should be applied as soon as possible.

A vulnerability exists in the 1756 EN2* and 1756 EN3* products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Rockwell Automation ControlLogix Communications Modules are affected by multiple vulnerabilities, as follows:

  - A remote code execution vulnerability via crafted CIP messages. (CVE-2023-3595)

  - A denial of service vulnerability via crafted CIP messages. (CVE-2023-3596)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
501226	Rockwell Automation Select Communication Modules Out-of-Bounds Write (CVE-2023-3595)	Tenable OT Security	Tenable.ot	Remote	critical
177893	Rockwell Automation ControlLogix Communications Modules Multiple Vulnerabilities	Nessus	SCADA	Remote	critical

Detections

Analytics

CVE-2023-3595

critical

Tenable Plugins

critical

critical