EUVD-2026-37118
GHSA-gpr8-p742-hw62
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network access to diagnostics page discloses CIP Connection IDs only (C:L); chained DoS is not a direct impact of the disclosure primitive itself.
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs on the diagnostics webpage, which are accessible to any unauthenticated user on the network. This information can be leveraged by an attacker to construct malicious packets, leading to Denial-of-Service.
AnalysisAI
Unauthenticated information disclosure in Rockwell Automation CompactLogix 5370 PLCs exposes CIP Connection IDs via the controller's built-in web diagnostics page to any host with network access. The disclosed identifiers can be used by an attacker as a stepping-stone to craft malicious CIP packets, enabling a chained Denial-of-Service attack against active controller connections. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation of the initial information disclosure requires unauthenticated HTTP access to the CompactLogix 5370's embedded web server diagnostics page - no credentials, no special software, and no user interaction are needed for this step. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 6.3 reflects a network-exploitable (AV:N), low-complexity (AC:L), unauthenticated (PR:N, UI:N) information disclosure with low confidentiality impact on the vulnerable system (VC:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positioned on the OT network (e.g., via a compromised HMI workstation or a direct Ethernet connection to the industrial LAN) browses the CompactLogix 5370 diagnostics page without supplying credentials and retrieves the listed CIP Connection IDs. Using these valid session identifiers and knowledge of the CIP protocol, the attacker crafts specially constructed CIP packets referencing the harvested IDs and transmits them to the controller, causing it to fault, drop connections, or enter a denial-of-service state that halts automated processes. … |
| Remediation | Consult Rockwell Automation security advisory SD1776 at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1776.html for official patch guidance; no specific patched firmware version was included in the available intelligence data, so patch availability and version must be confirmed with the vendor directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Compactlogix 5370
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today