PT-2023-3664 · Rockwell Automation · 1756-En2Tp+7

Published 2023-07-12 · Updated 2024-05-22 · CVE-2023-3595

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rockwell Automation 1756-EN2T version Rockwell Automation 1756-EN2TK version Rockwell Automation 1756-EN2TXT version Rockwell Automation 1756-EN2TP version Rockwell Automation 1756-EN2TPK version Rockwell Automation 1756-EN2TPXT version Rockwell Automation 1756-EN2TR version Rockwell Automation 1756-EN2TRK version Rockwell Automation 1756-EN2TRXT version Rockwell Automation 1756-EN2F version Rockwell Automation 1756-EN2FK version Rockwell Automation 1756-EN3TR version Rockwell Automation 1756-EN3TRK version Rockwell Automation 1756-EN4TR version Rockwell Automation 1756-EN4TRK version Rockwell Automation 1756-EN4TRXT version

Description The issue is related to a buffer overflow in the memory of Rockwell Automation communication modules. This could allow a remote attacker to execute arbitrary code using a specially crafted CIP package. The vulnerability may enable a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages, including the ability to modify, deny, and exfiltrate data passing through the device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2023-03948

CVE-2023-3595

Affected Products

1756-En2F

1756-En2T

1756-En2Tp

1756-En2Tpxt

1756-En2Tr

1756-En3Tr

1756-En4Tr

1756-En4Trxt

References · 20

• https://bdu.fstec.ru/vul/2023-03948 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-3595 · Security Note
• https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010 · Vendor Advisory
• https://twitter.com/exfil0/status/1696493245709091084 · Twitter Post
• https://t.me/true_secator/4612 · Telegram Post
• https://twitter.com/1Ivango1/status/1689610804340166656 · Twitter Post
• https://twitter.com/cycsas/status/1696493450156257411 · Twitter Post
• https://twitter.com/TGazdowski/status/1689710753358692355 · Twitter Post
• https://twitter.com/opsmatters_uk/status/1722764288379515374 · Twitter Post
• https://t.me/cvenotify/54144 · Telegram Post
• https://cisa.gov/news-events/ics-advisories/icsa-23-193-01 · Note
• https://t.me/true_secator/5765 · Telegram Post
• https://twitter.com/ZinoVersluys/status/1740002665655095756 · Twitter Post
• https://t.me/cibsecurity/66547 · Telegram Post
• https://twitter.com/CebercSecurity/status/1696493411770007770 · Twitter Post