CISA warns of high-severity Rockwell Automation controller flaw
CISA published an advisory on a Rockwell Automation controller flaw, identified as CVE-2021-42260, that could cause a major nonrecoverable fault in affected devices.
CISA has issued an advisory for several Rockwell Automation industrial controllers, saying a flaw identified as CVE-2021-42260 could allow crafted data to trigger a denial-of-service condition.
The advisory covers ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix and Compact GuardLogix products. CISA said the issue could lead to a major nonrecoverable fault, or MNRF, in affected systems.
Why it matters
Industrial controllers help run processes in factories, utilities and other operational technology settings. A denial-of-service issue in those devices can interrupt operations and force recovery steps that vary by controller type.
CISA said safety controllers require a program download to recover, while non-safety controllers require a stage 2 reset.
Context and background
The advisory lists affected product lines and versions earlier than 34.015, 35.014, 36.013 and 37.011. CISA said the flaw is marked as known affected for the listed products.
In its scoring, CISA assigned the issue a CVSS v3.1 base score of 7.5, with a high severity rating, and a CVSS v4.0 base score of 8.7, also rated high. The advisory maps the issue to CWE-835, described as a loop with no reachable exit condition, or an infinite loop.
CISA said Rockwell Automation reported the vulnerability to the agency. The advisory also says no known public exploitation specifically targeting the flaw has been reported to CISA at this time.
What officials said
Rockwell Automation recommends updating to firmware versions 34.015, 35.014, 36.013 or 37.011, depending on the product branch, with later versions also covered, CISA said.
For organizations that cannot upgrade, CISA advises using Rockwell Automation security best practices and general industrial control system defenses. Those steps include minimizing network exposure, placing control networks and remote devices behind firewalls, isolating them from business networks, and using secure remote access methods such as VPNs.
CISA also advises organizations to perform impact analysis and risk assessment before deploying defensive measures and to report suspected malicious activity to the agency for tracking and correlation.
What happens next
CISA’s advisory says the initial release date was 2026-09-01 and includes a revision entry the same day labeled “Initial republication of Rockwell Automation advisory.” Organizations using the affected controller families can review the firmware guidance and defensive steps in the advisory and vendor materials.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()