Rockwell CompactLogix DoS flaws expose industrial controllers
Two vulnerabilities in Rockwell Automation CompactLogix 5370 controllers allow unauthenticated attackers to trigger denial-of-service via CIP protocol flaws.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA disclosed two vulnerabilities affecting Rockwell Automation CompactLogix 5370 L1, L2, and L3 controllers deployed worldwide in critical manufacturing environments. CVE-2025-11694 stems from missing validation of sequence numbers and source IP addresses in the Common Industrial Protocol (CIP), allowing attackers to abuse exposed Connection IDs to trigger minor faults and denial-of-service conditions. CVE-2026-9307 involves the controller's web server exposing CIP Connection IDs on diagnostics pages to unauthenticated users, providing attackers the information needed to craft malicious packets for DoS attacks.
Rockwell Automation has released firmware version V38.011 to remediate both vulnerabilities and published security advisory SD1776 with detailed mitigation guidance. CISA recommends organizations minimize network exposure for affected control systems, isolate them from business networks, and implement defense-in-depth strategies. No active exploitation targeting these vulnerabilities has been reported to CISA at this time.
The vulnerabilities affect a widely deployed industrial controller platform used in critical manufacturing sectors globally, creating potential operational disruption risk if exploited. Organizations operating affected CompactLogix controllers should prioritize patching and implement network segmentation controls per CISA guidance.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-167-04
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs