CVE-2023-3595

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 5.53%
EPSS Percentile: 92.77%
CISA KEV: Not listed

Description

Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 12-Jul-2023 20:15
Last Modified: 17-Jun-2026 13:14
EPSS Date: 2026-10-27
CWE: CWE-787

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

rockwellautomation / 1756-en2f_series_a_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2f_series_a_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en2f_series_b_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2f_series_b_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en2f_series_c_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2f_series_c_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en2t_series_a_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2t_series_a_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en2t_series_b_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2t_series_b_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en2t_series_c_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2t_series_c_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en2t_series_d_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2t_series_d_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en2tr_series_a_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2tr_series_a_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en2tr_series_b_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2tr_series_b_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en2tr_series_c_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en2tr_series_c_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en3tr_series_a_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en3tr_series_a_firmware:-:*:*:*:*:*:*:*
rockwellautomation / 1756-en3tr_series_b_firmware
Version / affected range: -
cpe:2.3:o:rockwellautomation:1756-en3tr_series_b_firmware:-:*:*:*:*:*:*:*

References

af854a3a-2127-422b-91ae-364da2661108

Last enrichment sync: 28-Oct-2026 10:04
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

2023, Rockwell Automation and CISA issued an urgent disclosure regarding critical vulnerabilities (CVE-2023-3595 and CVE-2023-3596) found within the 1756-EN2, EN3, and EN4 communication modules. These modules are Team Cymru Reports Thousands of Internet-Exposed ICS Devices

CVE (1)

Malware (1)

Threat Actors (3)

MITRE ATT&CK (2)

Vendors (7)

Products (4)

Tools (2)

Industries (2)

Countries (5)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.