Rockwell CompactLogix/ControlLogix CVE-2026-11317

The attacker needs IP reachability to the controller's EtherNet/IP CIP service (typically TCP/UDP 44818 and UDP 2222) and the ability to send a crafted CIP message; no authentication, user interaction, or prior foothold on the controller is required (PR:N, UI:N, AT:N). Exploitation is more reliable against CompactLogix and ControlLogix models with smaller RAM footprints, per the vendor advisory. The principal limiting factor in practice is network exposure: in environments that follow ISA/IEC 62443 segmentation the controller is unreachable from IT or the internet, restricting the attack to insiders or attackers who have already pivoted into the OT cell or line zone.

All available signals point to a real OT priority despite no public exploit. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H means a single unauthenticated packet on the EtherNet/IP-reachable network can crash a controller - low complexity, no preconditions, high availability impact, score 8.7. There is no confidentiality or integrity impact, so this is purely a disruption issue, but in an ICS context disruption means stopped production and, for controllers governing physical processes, possible safety-system trips. No EPSS, KEV, or SSVC data was supplied, and no POC reference is included, so widespread opportunistic exploitation is not yet evidenced; however, CIP fuzzing crashes have historically been weaponized quickly once advisories publish. The notable mismatch worth flagging is that AV:N assumes a routable network path - in well-segmented OT environments (Purdue Level 1/2 isolated from IT) the realistic attack surface is much narrower than the headline score suggests, so defenders should weight the score against actual network exposure of their controllers.

An attacker who reaches the EtherNet/IP network - for example through a flat OT/IT network, a compromised engineering laptop, or an internet-exposed controller - sends a single crafted CIP message to TCP/UDP 44818 on a CompactLogix or ControlLogix controller. The controller enters a Major Non-Recoverable Fault, halting the controlled process; recovery requires an engineer to connect with Studio 5000 and perform a full program download, extending the outage well beyond the initial crash. No public exploit identified at time of analysis, but CIP malformation crashes are well within the capability of any actor with an EtherNet/IP fuzzer.