title: Rockwell Automation Select Logix Communication Modules Vulnerable to Email Object Buffer Overflow
description:
A buffer overflow vulnerability exists in the Rockwell Automation select 1756-EN* communication devices. If exploited, a threat actor could potentially leverage this vulnerability to perform a remote code execution. To exploit this vulnerability, a threat actor would have to send a maliciously crafted CIP request to device.
problem types: CWE-121 Stack-based Buffer Overflow
affected:
{
defaultStatus: unaffected
product: 1756-EN2T Series A, B, C
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN2T Series D
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN2TK Series A, B, C
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN2TXT Series A, B, C
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN2TXT Series D
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN2TP Series A
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN2TPK Series A
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN2TPXT Series A
vendor: Rockwell Auotmation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN2TR Series A, B
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN2TR Series C
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN2TRK Series A, B
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN2TRK Series C
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN2TRXT Series A, B
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN2TRXT Series C
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN2F Series A, B
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN2F Series C
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN2FK Series A, B
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN2FK Series C
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
{
defaultStatus: unaffected
product: 1756-EN3TR Series A
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN3TR Series B
vendor: Rockwell Automation
versions:
status: affected, version: <=11.003
}
{
defaultStatus: unaffected
product: 1756-EN3TRK Series A
vendor: Rockwell Automation
versions:
status: affected, version: <=5.008 & 5.028
}
{
defaultStatus: unaffected
product: 1756-EN3TRK Series B
vendor: Rockwell Automation
versions:
status: affected, version: <=11.002
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Update firmware. Update EN2* ControlLogix communications modules to mitigated firmware.
*  Restrict traffic to the SMTP port (25), if not needed.
*  Customers using the EN2/EN3 versions 10.x and higher can disable the email object, if not needed. Instructions can be found in the  EtherNet/IP Network Devices User Manual (rockwellautomation.com) https://literature.rockwellautomation.com/idc/groups/literature/documents/um/enet-um006_-en-p.pdf , publication ENET-UM006.
*   QA43240 - Recommended Security Guidelines from Rockwell Automation https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1085012