CVE-2012-6438 in ControlLogix controllers
Summary
by MITRE
The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the NIC to crash. Successful exploitation of this vulnerability could cause loss of availability and a disruption in communications with other connected devices.
Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/03/2026
The vulnerability identified as CVE-2012-6438 represents a critical buffer overflow condition affecting Rockwell Automation EtherNet/IP communication modules and controllers across multiple product lines. This flaw exists within the EtherNet/IP protocol implementation of industrial control systems, specifically impacting devices that utilize the Common Industrial Protocol for communication. The affected equipment includes various communication modules such as the 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB modules, alongside CompactLogix controllers in L32E and L35E variants, FLEXLogix adapters, and numerous ControlLogix, GuardLogix, and SoftLogix controllers spanning multiple firmware versions. The vulnerability stems from inadequate input validation within the network communication stack, where malformed CIP (Common Industrial Protocol) packets can trigger memory corruption when processed by the affected devices. This buffer overflow condition manifests as a remote code execution vector that can be exploited from outside the network perimeter, making it particularly dangerous in industrial environments where operational technology systems are often interconnected with corporate networks. The technical implementation flaw aligns with CWE-121, which describes stack-based buffer overflow conditions, and CWE-122, which covers heap-based buffer overflow scenarios, both of which are common in industrial protocol implementations where memory management is critical for real-time performance. The operational impact of this vulnerability extends beyond simple denial of service, as the affected devices may experience complete network interface controller crashes, leading to extended communication outages that can disrupt entire manufacturing processes. When the buffer overflow occurs, it typically results in system instability, requiring manual intervention to restore functionality through device rebooting or firmware reprogramming. The attack surface is particularly concerning given that EtherNet/IP is widely deployed in critical infrastructure environments, including oil and gas, water treatment, and manufacturing facilities where continuous operation is essential. According to ATT&CK framework, this vulnerability maps to T1205 which covers traffic duplication and T1499 which covers endpoint disruption, demonstrating how remote attackers can leverage protocol-level flaws to create cascading failures in industrial control systems. The vulnerability exploitation requires minimal technical expertise as attackers only need to send specifically crafted CIP packets to the affected devices, making it a significant risk for organizations that have not implemented proper network segmentation or intrusion detection systems. Organizations operating these affected controllers should consider implementing network access controls, firewall rules that restrict EtherNet/IP traffic to authorized sources, and periodic network monitoring to detect unusual traffic patterns that may indicate exploitation attempts. Additionally, firmware updates from Rockwell Automation should be prioritized to address the buffer overflow conditions, though organizations must carefully plan these updates to avoid operational disruptions in mission-critical environments where scheduled maintenance windows may be required to safely apply patches. The vulnerability highlights the importance of secure coding practices in industrial protocol implementations and demonstrates how legacy systems may contain unpatched security flaws that pose significant risks to operational technology environments.