EUVD-2026-43709
GHSA-fvq9-7g3p-r5g2
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N) but AC:H because the attacker must hold a certificate under a revoked intermediate; the trust bypass yields confidentiality impact only (C:H, I:N/A:N).
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
Lifecycle Timeline
2DescriptionCVE.org
A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.
AnalysisAI
Certificate revocation bypass in Rockwell Automation ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380, and 1756-EN4TR (EN4) communication modules allows a network-based attacker to establish a CIP Security connection using a certificate whose issuing intermediate CA has been revoked. Because the controller does not honor the Certificate Revocation List (CRL) for a revoked intermediate, an attacker holding such a certificate can present it as trusted and bypass CIP Security authentication. No public exploit identified at time of analysis; the vendor rates it CVSS 4.0 8.2 (High).
Technical ContextAI
The affected devices are Rockwell Automation Logix-family programmable controllers and the 1756-EN4TR EtherNet/IP communication module, which implement CIP Security - the ODVA security extension to the Common Industrial Protocol (CIP/EtherNet/IP) that uses X.509 certificates and TLS/DTLS to authenticate and encrypt controller communications. The root cause is CWE-299 (Improper Check for Certificate Revocation): the controller validates the certificate chain but fails to reject end-entity certificates signed by an intermediate CA that has been revoked through a CRL. In a correct PKI implementation, revoking an intermediate CA should invalidate every certificate beneath it; here the intermediate's revocation status is not enforced, so the trust decision relies only on chain signature validity rather than on current revocation state.
RemediationAI
Patch available per vendor advisory: apply the corrected firmware for the affected ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380, and 1756-EN4TR products as documented in Rockwell Automation advisory SD1788 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1788.html); the exact fixed firmware version is not stated in the available data and should be taken from that advisory. Until firmware can be updated, reduce exposure by restricting network access to the controllers' EtherNet/IP/CIP interfaces so only trusted engineering hosts can reach them (segment OT networks and enforce firewall rules on CIP ports), which limits who can attempt a connection but does not restore CRL enforcement. Where a compromised or improperly issued intermediate CA is the concern, re-issue the CIP Security PKI from a clean trust anchor and rotate device certificates, accepting the operational effort of redistributing certificates as the trade-off for removing the untrusted intermediate from any usable trust path.
Same weakness CWE-299 – Improper Check for Certificate Revocation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today