ICS Advisory: Rockwell Automation ControlLogix and GuardLogix

Summary:

The View CSAF document details a vulnerability in Rockwell Automation's ControlLogix, GuardLogix, CompactLogix, and 1756-EN4TR programmable logic controllers. The vulnerability, rated CVSS v4 9.2, allows an attacker to cause a major nonrecoverable fault (MNRF) resulting in the product becoming unavailable. The affected products are ControlLogix 5580 (version V35.011), GuardLogix 5580 (version V35.011), CompactLogix 5380 (version V35.011), and 1756-EN4TR (version V5.001). To mitigate this vulnerability, Rockwell Automation has released product updates, and CISA recommends users take defensive measures such as minimizing network exposure, locating control systems behind firewalls, and using more secure remote access methods.