Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution
Priority MEDIUM 50CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.
Why it matters now
EPSS 0.05526 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Rockwell | 1756-EN2T Series A, B, C | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN2T Series D | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TK Series A, B, C | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TXT Series A, B, C | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TXT Series D | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TP Series A | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TPK Series A | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TPXT Series A | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TR Series A, B | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TR Series C | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TRK Series A, B | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TRK Series C | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TRXT Series A, B | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN2TRXT Series C | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN2F Series A, B | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN2F Series C | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN2FK Series A, B | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN2FK Series C | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN3TR Series A | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN3TR Series B | up to 11.003 | — | No fix listed | CNA |
| Rockwell | 1756-EN3TRK Series A | <=5.008 & 5.028 | — | No fix listed | CNA |
| Rockwell | 1756-EN3TRK Series B | up to 11.003 | — | No fix listed | CNA |
- 1756-EN2T Series A, B, C VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN2T Series D VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN2TK Series A, B, C VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN2TXT Series A, B, C VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN2TXT Series D VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN2TP Series A VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN2TPK Series A VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN2TPXT Series A VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN2TR Series A, B VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN2TR Series C VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN2TRK Series A, B VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN2TRK Series C VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN2TRXT Series A, B VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN2TRXT Series C VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN2F Series A, B VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN2F Series C VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN2FK Series A, B VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN2FK Series C VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN3TR Series A VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN3TR Series B VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
- 1756-EN3TRK Series A VendorRockwell Affected <=5.008 & 5.028 Fixed in — No fix listed CNA
- 1756-EN3TRK Series B VendorRockwell Affected up to 11.003 Fixed in — No fix listed CNA
CPE configurations NVD · 24
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:rockwellautomation:1756-en2f_series_a_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2f_series_a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en2f_series_b_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2f_series_b:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en2f_series_c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2f_series_c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en2t_series_a_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2t_series_a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en2t_series_b_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2t_series_b:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
- cpe:2.3:o:rockwellautomation:1756-en2f_series_a_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2f_series_a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en2f_series_b_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2f_series_b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en2f_series_c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2f_series_c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en2t_series_a_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2t_series_a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en2t_series_b_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2t_series_b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
Show 14 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:rockwellautomation:1756-en2t_series_c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2t_series_c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en2t_series_d_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2t_series_d:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en2tr_series_a_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2tr_series_a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en2tr_series_b_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2tr_series_b:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en2tr_series_c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en2tr_series_c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en3tr_series_a_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en3tr_series_a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
| cpe:2.3:o:rockwellautomation:1756-en3tr_series_b_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Rockwell |
| cpe:2.3:h:rockwellautomation:1756-en3tr_series_b:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Rockwell |
- cpe:2.3:o:rockwellautomation:1756-en2t_series_c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2t_series_c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en2t_series_d_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2t_series_d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en2tr_series_a_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2tr_series_a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en2tr_series_b_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2tr_series_b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en2tr_series_c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en2tr_series_c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en3tr_series_a_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en3tr_series_a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
- cpe:2.3:o:rockwellautomation:1756-en3tr_series_b_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Rockwell
- cpe:2.3:h:rockwellautomation:1756-en3tr_series_b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Rockwell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-3595
- 2026-10-03 Alias added: GHSA-qvv4-3g8f-rgjx
References
More Rockwell 1756-en2f Series A Firmware vulnerabilities
- TI-2018-12755 Missing authentication in Rockwell Automation CVSS 3.1HIGH 8.6
- TI-2023-02121 Rockwell Automation Select Logix Communication Modules Vulnerable to Email Object Buffer Overflow CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-3595 · CVE Program
- CVE-2023-3595 · NVD
- FIRST EPSS
- GHSA-qvv4-3g8f-rgjx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences