Rockwell Logix PLCs EUVD-2026-69133

Exploitation requires network reachability to the affected PLC's EtherNet/IP interface (TCP/UDP port 44818). The CVSS 4.0 vector PR:N and UI:N confirm no authentication and no user interaction are required. No special non-default configuration is needed - CIP over EtherNet/IP is the standard communication interface for these controllers and is enabled in default deployments. Exploitation is limited by network access: if the PLC is properly segmented behind an industrial firewall or resides on a non-routable OT VLAN inaccessible from attacker-controlled networks, the attack surface is eliminated. Controllers in flat OT-IT network architectures or with internet-facing EtherNet/IP exposure are at materially higher risk. There is no requirement for a specific operating mode (e.g., run vs. program mode) stated in the available data.

The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) accurately reflects the attack profile: no authentication, no user interaction, and low complexity over the network. The sole impact is high availability loss to the vulnerable system. EPSS data was not provided, and the CVE is not listed in CISA KEV, meaning active exploitation is not confirmed. No public proof-of-concept is identified. Despite these lower exploitation signals, the real-world risk is disproportionate to the CVSS availability-only rating: in industrial control environments, a forced power cycle on a production PLC can halt manufacturing lines, disrupt safety interlocks, or cause process upsets - operational impacts that CVSS does not capture. The CVSS subsequent-system impact (SC/SI/SA:N) formally reflects only the cyber scope, but physical process consequences for downstream machinery or personnel should be factored into site-specific risk assessments. The lack of any authentication requirement (PR:N) on a protocol that is often network-exposed in flat OT network architectures significantly lowers the barrier for exploitation.

An attacker with access to the EtherNet/IP network segment hosting the CompactLogix or ControlLogix PLC - whether through a compromised IT network, rogue device on a flat OT network, or unauthorized physical network connection - sends a single crafted CIP message containing an out-of-bounds input length value. The controller's CIP parser fails to validate the field length, triggering a Major Nonrecoverable Fault that immediately halts all PLC program execution and requires a physical power cycle to restore, potentially stopping an automated production line or disabling a critical process controller. No public proof-of-concept exploit has been identified, but the attack requires only standard CIP protocol knowledge and low implementation complexity.