What is CVE-2023-3595?

CVE-2023-3595 is a critical-severity vulnerability in Rockwell Auotmation 1756-En2tpxt Series A, classified under Out-of-bounds Write. CVSS score: 9.8/10. Published 2023-07-12.

How severe is CVE-2023-3595?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Buffer overflow in Rockwell Auotmation 1756-En2tpxt Series A

CVE-2023-3595

Where this vulnerability exists in the Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products, it could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

Vulnerability class: Buffer Overflow

Published 2023-07-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.055 (92.5th percentile), scored 2026-09-30.

Low probability of exploitation in the next 30 days, but still tracked. 93rd percentile — 92.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.055 · newest: 0.055 · change: 0.000

Affected products

Rockwell Auotmation 1756-En2tpxt Series A — versions <=11.003
Rockwell Automation 1756-En2fk Series A, B — versions <=5.008 & 5.028
Rockwell Automation 1756-En2fk Series C — versions <=11.003
Rockwell Automation 1756-En2f Series A, B — versions <=5.008 & 5.028
Rockwell Automation 1756-En2f Series C — versions <=11.003
Rockwell Automation 1756-En2tk Series A, B, C — versions <=5.008 & 5.028
Rockwell Automation 1756-En2tpk Series A — versions <=11.003
Rockwell Automation 1756-En2tp Series A — versions <=11.003
Rockwell Automation 1756-En2trk Series A, B — versions <=5.008 & 5.028
Rockwell Automation 1756-En2trk Series C — versions <=11.003

Weakness classification (CWE)

CWE-787 — Out-of-bounds Write

References

rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1140010 (Permissions Required, Vendor Advisory)

Frequently asked questions

What is CVE-2023-3595?: CVE-2023-3595 is a critical-severity vulnerability in Rockwell Auotmation 1756-En2tpxt Series A, classified under Out-of-bounds Write. CVSS score: 9.8/10. Published 2023-07-12.
How severe is CVE-2023-3595?: Critical severity. CVSS v3 base score is 9.8 out of 10.