CISA warns of Rockwell Automation Logix flaw that can trigger controller faults
CISA issued an ICS advisory on a Rockwell Automation Logix Platform vulnerability that can trigger a major nonrecoverable fault in affected controllers. Rockwell Automation has released firmware updates, and CISA says it has not seen known public exploitation.
CISA says a Rockwell Automation Logix Platform vulnerability could cause a denial-of-service condition in several controller firmware versions, with fixes available and no known public exploitation reported.
CISA published an industrial control systems advisory on Sept. 1 about a Rockwell Automation Logix Platform vulnerability identified as CVE-2026-9637. The agency said the flaw can lead to a denial-of-service condition in affected controllers after improper validation of input length during CIP message processing.
CISA said the issue can trigger a major nonrecoverable fault, or MNRF, that requires a power cycle to recover. The advisory covers several Rockwell Automation product families used in industrial settings, including ControlLogix 5580, CompactLogix 5380, GuardLogix 5580 and Compact GuardLogix 5380.
CISA rated the vulnerability high severity. The advisory lists a CVSS v3.1 base score of 7.5 and a CVSS v4.0 base score of 8.7. CISA also mapped the issue to CWE-119, which it describes as improper restriction of operations within the bounds of a memory buffer.
The advisory says affected versions include <=V33, V34.011-V34.014, V35.011-V35.013 and V36.011-V36.012 for the listed product families. It marks the products as known affected and says the devices are deployed worldwide, with Rockwell Automation headquartered in the United States.
Rockwell Automation recommends updating to firmware versions V37.011, 34.015, 35.014 or 36.013, depending on the product and version. If customers cannot upgrade, the company advises using its security best practices.
CISA said it has not received reports of known public exploitation specifically targeting the vulnerability. The agency also said Rockwell Automation reported the issue to CISA.
CISA’s general guidance for industrial control systems includes limiting network exposure, placing control system networks behind firewalls and away from business networks, and using VPNs carefully for remote access. The agency also advises operators to run impact analysis and risk assessments before making defensive changes, follow ICS recommended practices, report suspected malicious activity to CISA and avoid unsolicited links or attachments.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()