CVE-2023-3595
Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution
- 9.8CriticalCVSS base score
- 5.5%Exploitation in 30 daysEPSS · top 7.1% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.
Timeline
ID reserved
By Rockwell
- 2 days later
· 2 days later
Published
- 13 months later
· 13 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| RockwellCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 5.5% · top 7.1% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
Rockwell Automation · 1756-EN2T Series A, B, C
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN2T Series D
- affected <=11.003
Rockwell Automation · 1756-EN2TK Series A, B, C
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN2TXT Series A, B, C
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN2TXT Series D
- affected <=11.003
Rockwell Automation · 1756-EN2TP Series A
- affected <=11.003
Rockwell Automation · 1756-EN2TPK Series A
- affected <=11.003
Rockwell Auotmation · 1756-EN2TPXT Series A
- affected <=11.003
Rockwell Automation · 1756-EN2TR Series A, B
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN2TR Series C
- affected <=11.003
Rockwell Automation · 1756-EN2TRK Series A, B
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN2TRK Series C
- affected <=11.003
Rockwell Automation · 1756-EN2TRXT Series A, B
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN2TRXT Series C
- affected <=11.003
Rockwell Automation · 1756-EN2F Series A, B
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN2F Series C
- affected <=11.003
Rockwell Automation · 1756-EN2FK Series A, B
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN2FK Series C
- affected <=11.003
Rockwell Automation · 1756-EN3TR Series A
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN3TR Series B
- affected <=11.003
Rockwell Automation · 1756-EN3TRK Series A
- affected <=5.008 & 5.028
Rockwell Automation · 1756-EN3TRK Series B
- affected <=11.003
What to do
Solution: * Update firmware. Update EN2* ControlLogix communications modules to mitigated firmware. * Properly segment networks. Given a cyber actor would require network connectivity to the communication module to exploit the vulnerability, organizations should ensure ICS/SCADA networks are properly segmented within the process structure as well as from the Internet and other non-essential networks. * Implement detection signatures. Use appended Snort signatures to monitor and detect anomalous Common Industrial Protocol (CIP) packets to Rockwell Automation devices.
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2023-44245 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2023-3595)Record last updated .