CVE-2012-6440

MediumCVSS 4.8/10Last modified Jun 16, 2026

Description

The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information.

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-287

Affected software

VendorProductVersions
Rockwell Automation1756-ENBT, 1756-EWEB, 1768-ENBT, 1768-EWEB communication modulesAll
Rockwell AutomationCompactLogix L32E and L35E controllersAll
Rockwell Automation1788-ENBT FLEXLogix adapterAll
Rockwell Automation1794-AENTR FLEX I/O EtherNet/IP adapterAll
Rockwell AutomationControlLogix, CompactLogix, GuardLogix, and SoftLogix<= 18
Rockwell AutomationCompactLogix and SoftLogix controllers<= 19
Rockwell AutomationControlLogix and GuardLogix controllers<= 20
Rockwell AutomationMicroLogix1100; 1400

References

Timeline

Published
Jan 24, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2012

CVE-2012-64415.0An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2CVE-2012-64427.5When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/CVE-2012-64474.3Cross-site scripting (XSS) vulnerability in Splunk Web in Splunk 5.0.0 through 5.0.2 allows remote attackers to inject arbitrary web script CVE-2012-64486.1Cross-site Scripting (XSS) in cPanel WebHost Manager (WHM) 11.34.0 allows remote attackers to inject arbitrary web script or HTML via unspecCVE-2012-64495.4The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.CVE-2012-64519.8Lorex LNC116 and LNC104 IP Cameras have a Remote Authentication Bypass VulnerabilityCVE-2012-64525.0Axway Secure Messenger before 6.5 Updated Release 7, as used in Axway Email Firewall, provides different responses to authentication requestCVE-2012-64534.3Cross-site scripting (XSS) vulnerability in the RSS Reader extension before 0.2.6 for MediaWiki allows remote attackers to inject arbitrary CVE-2012-64584.3Multiple cross-site scripting (XSS) vulnerabilities in the SilverStripe e-commerce module 3.0 for SilverStripe CMS allow remote attackers toCVE-2012-64594.3ConnMan 1.3 on Tizen continues to list the bluetooth service after offline mode has been enabled, which might allow remote attackers to obtaCVE-2012-64605.0Opera before 11.67 and 12.x before 12.02 allows remote attackers to cause truncation of a dialog, and possibly trigger downloading and execuCVE-2012-64615.0The X.509 certificate-validation functionality in the https implementation in Opera before 12.10 allows remote attackers to trigger a false
CVE-2012-6440: Medium severity, CVSS 4.8 | Vulnix