Security readout for executives and security teams
Plain-English summary
This flaw can let an unauthorized network source send a valid EtherNet/IP CIP message that causes affected Rockwell controllers or modules to stop logic execution and enter a fault state. The business impact is availability loss: disrupted PLC operation and communication with connected devices.
Executive priority
Prioritize for industrial sites where affected Rockwell PLCs support safety, production, or uptime-critical processes. Treat internet, remote-access, or flat-network exposure as urgent, even without confirmed active exploitation.
Technical view
CVE-2012-6435 is improper access control in Rockwell Automation EtherNet/IP products. A valid CIP message to TCP/UDP 2222 or 44818 can trigger CPU fault behavior and denial of service. CVSS v2 is 7.8, network reachable, low complexity, no authentication, availability impact only.
Likely exposure
Exposure is most relevant where listed Rockwell ControlLogix, CompactLogix, GuardLogix, SoftLogix, MicroLogix, FLEXLogix, FLEX I/O, or communication modules can receive EtherNet/IP traffic from unintended sources on TCP/UDP 2222 or 44818.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The issue is still serious because no authentication is required in the CVSS vector, and successful abuse can stop logic execution in industrial control environments.
Researcher notes
Evidence supports a denial-of-service condition through valid CIP traffic to EtherNet/IP service ports. The source bundle does not provide exploit details, confirmed exploitation, or complete remediation text. Product/version metadata appears broad, so validate against vendor advisories before declaring scope.
Mitigation direction
- Review Rockwell Automation and CISA advisory guidance for product-specific remediation.
- Limit TCP/UDP 2222 and 44818 access to authorized ICS hosts only.
- Isolate affected PLC networks from enterprise and internet-reachable networks.
- Inventory listed Rockwell products and confirm firmware or controller versions.
- Apply vendor-approved updates or configuration changes when identified.
Validation and detection
- Identify assets matching the affected Rockwell product list.
- Confirm whether TCP/UDP 2222 or 44818 is reachable from unintended networks.
- Review network controls between enterprise, remote access, and ICS segments.
- Check logs or historian events for unexplained controller fault states.
- Document vendor advisory status for each affected asset.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2012-6435 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:N/C:N/I:N/A:C106.9icscertCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 2.0 score
7.8HighVector: AV:N/AC:L/Au:N/C:N/I:N/A:C
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-03CVE reference, icscert
- https://rockwellautomation.custhelp.com/app/answers/detail/a_id/470154CVE reference, icscert
- https://rockwellautomation.custhelp.com/app/answers/detail/aid/470155CVE reference, icscert
- https://rockwellautomation.custhelp.com/app/answers/detail/aid/470156CVE reference, icscert
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.