CVE-2023-3595

criticalpriority · track · 41EPSS 0.055 · 93 %ileEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
5.53% (93rd) EPSS
CVSS 9.8 · critical
Is it mine?
208 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · scored 2026-10-27

Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixed1756-EN2F Series Acisa_csaf_ot

    1756-EN2F Series A: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2F Series Bcisa_csaf_ot

    1756-EN2F Series B: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2F Series Ccisa_csaf_ot

    1756-EN2F Series C: Update to 11.004 or later

  • Fixed1756-EN2FK Series Acisa_csaf_ot

    1756-EN2FK Series A: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2FK Series Bcisa_csaf_ot

    1756-EN2FK Series B: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2FK Series Ccisa_csaf_ot

    1756-EN2FK Series C: Update to 11.004 or later

  • Fixed1756-EN2T Series Acisa_csaf_ot

    1756-EN2T Series A: Update to 5.029 or later signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2T Series Bcisa_csaf_ot

    1756-EN2T Series B: Update to 5.029 or later signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2T Series Ccisa_csaf_ot

    1756-EN2T Series C: Update to 5.029 or later signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2T Series Dcisa_csaf_ot

    1756-EN2T Series D: Update to 11.004 or later

  • Fixed1756-EN2TK Series Acisa_csaf_ot

    1756-EN2TK Series A: Update to 5.029 or later signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TK Series Bcisa_csaf_ot

    1756-EN2TK Series B: Update to 5.029 or later signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TK Series Ccisa_csaf_ot

    1756-EN2TK Series C: Update to 5.029 or later signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TK Series Dcisa_csaf_ot

    1756-EN2TK Series D: Update to 11.004 or later

  • Fixed1756-EN2TP Series Acisa_csaf_ot

    1756-EN2TP Series A: Update to 11.004 or later

  • Fixed1756-EN2TPK Series Acisa_csaf_ot

    1756-EN2TPK Series A: Update to 11.004 or later

  • Fixed1756-EN2TPXT Series Acisa_csaf_ot

    1756-EN2TPXT Series A: Update to 11.004 or later

  • Fixed1756-EN2TR Series Acisa_csaf_ot

    1756-EN2TR Series A: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TR Series Bcisa_csaf_ot

    1756-EN2TR Series B: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TR Series Ccisa_csaf_ot

    1756-EN2TR Series C: Update to 11.004 or later

  • Fixed1756-EN2TRK Series Acisa_csaf_ot

    1756-EN2TRK Series A: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TRK Series Bcisa_csaf_ot

    1756-EN2TRK Series B: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TRK Series Ccisa_csaf_ot

    1756-EN2TRK Series C: Update to 11.004 or later

  • Fixed1756-EN2TRXT Series Acisa_csaf_ot

    1756-EN2TRXT Series A: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TRXT Series Bcisa_csaf_ot

    1756-EN2TRXT Series B: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TRXT Series Ccisa_csaf_ot

    1756-EN2TRXT Series C: Update to 11.004 or later

  • Fixed1756-EN2TXT Series Acisa_csaf_ot

    1756-EN2TXT Series A: Update to 5.029 or later signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TXT Series Bcisa_csaf_ot

    1756-EN2TXT Series B: Update to 5.029 or later signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TXT Series Ccisa_csaf_ot

    1756-EN2TXT Series C: Update to 5.029 or later signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN2TXT Series Dcisa_csaf_ot

    1756-EN2TXT Series D: Update to 11.004 or later

  • Fixed1756-EN3TR Series Acisa_csaf_ot

    1756-EN3TR Series A: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN3TR Series Bcisa_csaf_ot

    1756-EN3TR Series B: Update to 11.004 or later

  • Fixed1756-EN3TRK Series Acisa_csaf_ot

    1756-EN3TRK Series A: Update to 5.029 or later for signed versions (**recommended). Update to 5.009 for unsigned versions

  • Fixed1756-EN3TRK Series Bcisa_csaf_ot

    1756-EN3TRK Series B: Update to 11.004 or later

  • Fixed1756-EN4TR Series Acisa_csaf_ot

    1756-EN4TR Series A: Update to 5.002 or later

  • Fixed1756-EN4TRK Series Acisa_csaf_ot

    1756-EN4TRK Series A: Update to 5.002 or later

  • Fixed1756-EN4TRXT Series Acisa_csaf_ot

    1756-EN4TRXT Series A: Update to 5.002 or later

  • Mitigation1756-EN2F Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2F Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2F Series Ccisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2FK Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2FK Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2FK Series Ccisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2T Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2T Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2T Series Ccisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2T Series Dcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TK Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TK Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TK Series Ccisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TK Series Dcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TP Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TPK Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TPXT Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TR Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TR Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TR Series Ccisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TRK Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TRK Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TRK Series Ccisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TRXT Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TRXT Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TRXT Series Ccisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TXT Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TXT Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TXT Series Ccisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN2TXT Series Dcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN3TR Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN3TR Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN3TRK Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN3TRK Series Bcisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN4TR Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN4TRK Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

  • Mitigation1756-EN4TRXT Series Acisa_csaf_ot

    ** Rockwell Automation strongly recommends updating to signed firmware if possible. Once the module is updated to signed firmware (example 5.008 to 5.0029), it is not possible to revert to unsigned firmware versions.

02

cvss

Technical severity, 0–10. One row per scoring source.

9.8
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9
v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US
v3.19.8criticalAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · PSIRT@rockwellautomation.comexploitability 3.9 · impact 5.9
v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USprimaryCWE-787USCWE-787US
04

affected products (208)

Products and version ranges known to be affected.

showing 20 of 208
05

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSA-23-193-01Rockwell Automation Select Communication Modules2023-07-12icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could allow malicious actors to gain remote access of the running memory of the module and perform malicious activity.

06

also known as (5)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducisa_csaf_otNVDCVE.orgMITRE
published 2023-07-12modified 2026-06-17
09

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan