ControlLogix 5580 EUVD-2026-43709

Exploitation requires that CIP Security is enabled/configured on the target controller and that the attacker possesses a valid end-entity certificate whose signing intermediate CA has been revoked via a CRL - i.e., a certificate that chains to a now-untrusted intermediate. The attacker must have network reachability to the controller's EtherNet/IP CIP interface. Limiting factors: the vendor assigns high attack complexity (AC:H) and an explicit attack requirement (AT:P) precisely because obtaining a certificate under a revoked intermediate is non-trivial and typically implies prior legitimate issuance or CA compromise; the flaw grants no integrity or availability impact per the vendor vector. It is not exploitable against a default configuration in which no intermediate CA has been revoked.

The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) frames this as network-reachable and unauthenticated but high-complexity: exploitation carries an explicit Attack Requirement (AT:P) and high complexity (AC:H) because the attacker must actually possess a certificate signed by a specific intermediate CA that was later revoked - a non-trivial precondition implying prior legitimate issuance or CA compromise. Impact is scoped to confidentiality (VC:H) with no integrity or availability impact claimed, consistent with an authentication/trust bypass rather than code execution. There is no CISA KEV listing and no POC in the provided data, so this is a real-but-conditional priority for OT environments running CIP Security, not a mass-exploitable flaw. EPSS was not provided. The confidentiality-only rating (VI:N/VA:N) is worth verifying against operational reality - a bypassed CIP Security session could enable further controller interaction - so confirm impact scope against advisory SD1788.

An attacker who obtains an end-entity certificate signed by an intermediate CA that the operator has since revoked via CRL connects to a CompactLogix/ControlLogix controller over EtherNet/IP. Because the controller does not check the intermediate's revocation status, it accepts the certificate as trusted and the attacker establishes a CIP Security session that should have been rejected, bypassing intended authentication. The high attack complexity means this is most realistic where a formerly trusted certificate or CA was decommissioned or compromised.