by Kastro
Paper/Archive/CVE-2023-2262

CVE-2023-2262

Rockwell Automation 1756-EN2T Series A, B, C — Rockwell Automation Select Logix Communication Modules Vulnerable to Email Object Buffer Overflow

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 70.3.703 × 2014.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat actor would have to send a maliciously crafted CIP request to device.

Affected

ProductAffectedFixed inSource
1756-EN2T Series A, B, C<=5.008 & 5.028–CNA
1756-EN2T Series D<=11.002–CNA
1756-EN2TK Series A, B, C<=5.008 & 5.028–CNA
1756-EN2TXT Series A, B, C<=5.008 & 5.028–CNA
1756-EN2TXT Series D<=11.002–CNA
1756-EN2TP Series A<=11.002–CNA
1756-EN2TPK Series A<=11.002–CNA
1756-EN2TPXT Series A<=11.002–CNA
1756-EN2TR Series A, B<=5.008 & 5.028–CNA
1756-EN2TR Series C<=11.002–CNA
1756-EN2TRK Series A, B<=5.008 & 5.028–CNA
1756-EN2TRK Series C<=11.002–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Rockwell (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refrockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140786