EUVD-2025-210167
GHSA-9r9c-rxhr-5hcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain OT network reachability
-
DeliveryQuery controller web interface
-
ExploitHarvest exposed Connection IDs
-
ExecutionCraft spoofed CIP packets
-
PersistInject forged sequence numbers
-
ImpactTrigger minor controller fault
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Integrity verification
|
| Exploitation Conditions | The attacker must have network reachability to both the controller's web interface (to enumerate the exposed Connection IDs) and its CIP/EtherNet/IP service ports (typically TCP/UDP 44818 and UDP 2222) to inject forged session traffic; an active CIP connection must already exist on the target controller for there to be a Connection ID to abuse. Exploitation is limited to 1769 CompactLogix 5370 controllers, requires no authentication or user interaction per the CVSS 4.0 vector, and produces only a 'minor fault' - a recoverable controller state - rather than code execution or persistent compromise, which caps blast radius to availability disruption of the affected CIP session. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) indicates a network-reachable, unauthenticated, low-complexity attack with high availability impact and no confidentiality or integrity loss - consistent with the described denial-of-service outcome. There is no EPSS score, KEV listing, or public POC provided in the input, so this is currently a theoretical-but-credible risk rather than evidence of active exploitation. The real-world risk is heavily gated by deployment: CompactLogix controllers should never be directly internet-exposed, so the practical attack surface is anyone with reachability to the OT network segment (insider, compromised IT host, or exposed plant network). The CWE-354 mapping plus the 'Information Disclosure' tag is slightly inconsistent with a pure DoS outcome - the disclosed Connection IDs are the enabling info-leak, and the impact is a 'minor fault' (a recoverable controller fault state), not full controller takeover. |
| Exploit ScenarioDerived | An attacker who has gained a foothold on the OT network (or a flat enterprise network with reachability to the plant) queries the CompactLogix web interface over HTTP, harvests the active Connection IDs displayed there, and then crafts CIP packets spoofing those Connection IDs with arbitrary source IPs and sequence numbers. The controller accepts the forged traffic as part of a legitimate session, triggering a minor fault that disrupts the active CIP connection and can interrupt I/O scanning or HMI communication for the duration of the fault. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Denial-of-service in Rockwell Automation 1769 CompactLogix 5370 controllers allows remote unauthenticated attackers to induce a minor fault on the PLC by abusing Connection IDs exposed via the device's web interface and sending forged CIP traffic. The CVSS 4.0 base score of 8.7 reflects high availability impact with no authentication or user interaction required, and no public exploit has been identified at time of analysis.
RemediationAI
Patch availability is not explicitly stated in the provided input - consult Rockwell advisory SD1776 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1776.html) for vendor-released firmware updates for the 1769 CompactLogix 5370 family. Until a patched firmware is applied, restrict access to the controller's embedded web interface by blocking HTTP/HTTPS to the device from any host that does not require diagnostic access (this removes the Connection ID disclosure that enables the attack but breaks browser-based diagnostics); segment the controller onto an isolated OT VLAN with strict IP allow-listing for CIP traffic on TCP/UDP 44818 and CIP class 1 I/O on UDP 2222; and deploy a CIP-aware industrial firewall or IDS (e.g., Cisco Cyber Vision, Claroty CTD, Dragos) to detect forged sequence numbers and source-IP mismatches on established CIP connections. Do not expose any CompactLogix interface to the internet.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The 1769 CompactLogix 5370 is a programmable logic controller (PLC) family from Rockwell Automation used in industrial control systems, communicating over the Common Industrial Protocol (CIP) - typically encapsulated in EtherNet/IP on TCP/UDP 44818 and 2222. The vulnerability is a CWE-354 (Improper Validation of Integrity Check Value) class flaw: the controller's CIP stack does not validate sequence numbers or source IP addresses on incoming traffic for established CIP connections, while the device's HTTP-accessible diagnostic web interface discloses the active Connection IDs. An attacker who can read these Connection IDs can craft CIP packets that the controller accepts as legitimate session traffic, allowing forged messages to disrupt the active connection.
Know when Compactlogix 5370 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable, unauthenticated CIP traffic with no UI; impact is a recoverable 'minor fault' (partial, temporary availability loss), so A:L and C/I:N.
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
DescriptionCVE.org
A security issue exists within 1769 CompactLogix controllers due to the missing validation of sequence numbers and source IP addresses in the CIP protocol. This allows attacker to abuse the exposed Connection ID’s visible on the web interface to perform denial-of-service attacks, resulting in a minor fault.
Executive ViewAI
Rockwell Automation CompactLogix 5370 programmable logic controllers are vulnerable to remote, unauthenticated denial-of-service attacks via forged industrial protocol traffic, forcing controllers into a minor fault state and interrupting production. No vendor patch has been released, creating immediate operational risk for manufacturing and critical infrastructure environments relying on these controllers. Emergency network isolation measures are required pending vendor remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to controllers via firewall-allow only from trusted engineering jump hosts; (2) disable or password-protect the web interface if operationally feasible; (3) implement network-based IDS/IPS to detect and block CIP protocol anomalies and malformed Connection IDs; (4) enable continuous monitoring for unexpected PLC fault state transitions and system resets; (5) maintain offline backups of firmware and configurations to enable rapid restoration if exploitation occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB