Is CVE-2012-6441 automatically exploitable on my domain?

Not necessarily. ThreatPort treats CVE-2012-6441 as a risk signal that must be connected to observed external assets, detected technologies, and reachable services.

What does ThreatPort check for CVE-2012-6441?

ThreatPort looks for public asset evidence, service fingerprints, CVE-linked technology signals, exposed endpoints, weak DNS/TLS posture, and remediation context.

Should this replace vendor advisories?

No. Use vendor advisories and official patches for final remediation decisions; use ThreatPort to find externally visible exposure and prove cleanup.

CVE-2012-6441 Controllogix Controllers exposure check

From CVE Record to External Exposure

An information exposure of confidential information results when the device receives a specially crafted CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP. Successful exploitation of this vulnerability could cause loss of confidentiality. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

Controllogix Controllers vulnerability should be triaged by matching the affected vendor and product to live, internet-facing assets rather than treating the CVE as an abstract feed item. ThreatPort focuses on the first question that budget-constrained IT leaders and CISOs ask: what can an outside observer find today, how severe is it, and what should be fixed first?

Known Exploitation Record

Known ransomware campaign use: Not recorded
EPSS exploitation probability: 54.17% (99p)
CVSS base score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Disclosed: 2013-01-24
Weakness type: CWE-200

Source: CISA Known Exploited Vulnerabilities catalog and FIRST.org EPSS.

What ThreatPort Checks

Identify externally reachable services that appear related to Rockwellautomation Controllogix Controllers.

Map detected technologies to CVE-2012-6441, severity context, and practical remediation priority.

Check TLS, DNS, headers, exposed panels, stale endpoints, and service fingerprints from a public attacker perspective.

Produce a concise scorecard first, then unlock deeper AI pentest evidence and PDF reporting when remediation planning begins.

The output is intentionally practical: ownership clues, risk context, remediation hints, and repeatable evidence that can be shared with technical teams or leadership. It is not positioned as magic compliance automation or a replacement for human security judgment.

Lean security teams rarely need another broad vulnerability list. They need to know whether an exposed endpoint, an expired certificate, a weak DNS setting, or a CVE-linked service is likely to affect the systems they actually run. ThreatPort scans from the outside in, ranks what it finds by real reachability rather than raw CVSS, and hands back evidence a team can act on the same day.

Route-Specific Evidence Profile

CVE-2012-6441 affects Rockwellautomation Controllogix Controllers, a CWE-200 weakness. Disclosed 2013-01-24. This page exists to answer one question: is anything you own externally reachable and running it.

Assets This Page Should Care About

Public domains Subdomains Externally reachable web apps TLS endpoints DNS records

Signals Worth Prioritizing

Forgotten subdomains

Weak DNS or email controls

Outdated services

Risky headers

What Should Be Reviewed First in This Context?

For teams running Rockwellautomation Controllogix Controllers, the first step is to validate internet-facing assets with business relevance instead of producing a generic vulnerability list.