Which products and versions are affected by CVE-2012-6441?

Affected: Controllogix Controllers (Rockwellautomation); Guardlogix Controllers (Rockwellautomation); MicroLogix (Rockwellautomation) versions >= 1100, among others. The full list is in the CVE brief.

Is CVE-2012-6441 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2012-6441 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2012-6441?

No public exploit code is known.

Is there a fix for CVE-2012-6441?

Fixed versions are available, including Compactlogix 18, Compactlogix Controllers 19, Controllogix 18.

How urgently should CVE-2012-6441 be patched?

Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Request A Demo

Vulnerability Intelligence

CVE-2012-6441

Medium

An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP.

Published Jan 24, 2013 · Updated Apr 28, 2026

Key Facts

Patch immediately

CVE-2012-6441 is a medium-severity vulnerability (CVSS 5.0 v2) affecting Controllogix Controllers (Rockwellautomation), Guardlogix Controllers (Rockwellautomation), MicroLogix (Rockwellautomation) and 21 more products.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 57% probability of exploitation in the next 30 days.
Fixed versions are available, including Compactlogix 18, Compactlogix Controllers 19, Controllogix 18.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

CVSS v2

5.0

AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS (30-day exploit likelihood)

57%

Higher than 99.0% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2012-6441 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confidentiality.

Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

Affected Products

25 affected entries in total

Product	Affected versions	Fixed in
Controllogix ControllersRockwellautomation	See advisory	20
Guardlogix ControllersRockwellautomation	See advisory	20
MicroLogixRockwellautomation	>= 1100	1100
Softlogix ControllersRockwellautomation	See advisory	19
1756-EnbtRockwellautomation	See advisory	n/a

19 more affected products in the full CVE brief

Patched Releases

Compactlogix

Compactlogix Controllers

Controllogix

Controllogix Controllers

Guardlogix

Guardlogix Controllers

MicroLogix

1100

Softlogix

Softlogix Controllers

Timeline

Publicly disclosed
Jan 24, 2013
Last updated
Apr 28, 2026

Weakness Type

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

1 more references in the full CVE brief

FAQ

Common Questions.

An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP.
Affected: Controllogix Controllers (Rockwellautomation); Guardlogix Controllers (Rockwellautomation); MicroLogix (Rockwellautomation) versions >= 1100, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Compactlogix 18, Compactlogix Controllers 19, Controllogix 18.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.

Is CVE-2012-6441 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.