CVE-2012-6438: Rockwell Automation ControlLogix PLC Improper Input Validation
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the NIC to crash. Successful exploitation of this vulnerability could cause loss of availability and a disruption in communications with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
Description quoted from the CVE record (assigned by icscert, published 2013-01-24).
Weakness: CWE-119
How it can be exploited
Exploitable with low attack complexity. AV:N/AC:L/Au:N/C:N/I:N/A:C
CISA assessment (SSVC): CISA has no evidence of exploitation. Automatable: yes. Technical impact: partial.
Public exploit evidence (Exploit Observer)
Also known as: CNNVD-201301-258, EUVD-2012-6291, GHSA-qrw8-3h67-8hff
VEDAS cluster: VEDAS:ENGINEELK
Exploit Observer has no public exploit code that names this CVE or one of its aliases.
Vulnerability databases and vendor advisories (4)
Catalogue entries, not exploit evidence.
- Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2012-6291
- Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-qrw8-3h67-8hff
- Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2012-6438
- Vulnerability database or vendor advisory: https://www.cnnvd.org.cn/home/globalSearch?keyword=CNNVD-201301-258
13 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.
VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.
Live scores
- EPSS
- 0.355
likely to be attacked soon - VEDAS
- 0.952
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- None yet
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| Rockwell Automation 1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modules | version All | Not stated |
| Rockwell Automation CompactLogix L32E and L35E controllers | version All | Not stated |
| Rockwell Automation 1788-ENBT FLEXLogix adapter | version All | Not stated |
| Rockwell Automation 1794-AENTR FLEX I/O EtherNet/IP adapter | version All | Not stated |
| Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and SoftLogix | up to and including 18 | Not stated |
| Rockwell Automation CompactLogix and SoftLogix controllers | up to and including 19 | Not stated |
| Rockwell Automation ControlLogix and GuardLogix controllers | up to and including 20 | Not stated |
| Rockwell Automation MicroLogix | version 1100 version 1400 | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
Exploit Observer also maps it to: rockwellautomation 1756-enbt, rockwellautomation 1756-eweb, rockwellautomation 1768-enbt, rockwellautomation 1768-eweb, rockwellautomation 1794-aentr_flex_i\/o_ethernet\/ip_adapter, rockwellautomation compactlogix, rockwellautomation compactlogix_controllers, rockwellautomation compactlogix_l32e_controller, rockwellautomation compactlogix_l35e_controller, rockwellautomation controllogix.
How to fix it
No fixed version or vendor advisory is listed in the CVE record yet. Watch the vendor’s security page.
How to detect it
There is no open VEDAS detection rule for this bug yet. It is listed on the detection gaps page if CISA has confirmed attacks.
References
Other references
- https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03
- https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154
- https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155
- https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156
- http://rockwellautomation.custhelp.com/app/answers/detail/a_id/54102
- http://www.us-cert.gov/control_systems/pdf/ICSA-13-011-03.pdf (x_refsource_MISC, x_transferred)
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.