~/f4n6 $ grep -r "Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix" ./investigations/ --include="*.md"

Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix

Jeff Davies 01 Sep 2026 6 min read

1. Executive summary

CISA has republished a Rockwell Automation advisory (ICSA-26-244-05) covering a network-reachable denial-of-service vulnerability — CVE-2021-42260, CWE-835 "Loop with Unreachable Exit Condition ('Infinite Loop')" — affecting ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380 and CompactLogix 5480 controllers. The flaw is rated CVSS v3.1 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and CVSS v4.0 8.7 HIGH; no authentication, no user interaction, availability-only impact. A remote attacker sending corrupt crafted data can drive affected controllers into a major nonrecoverable fault (MNRF), with recovery requiring a program download (safety controllers) or a stage 2 reset (non-safety controllers) — a materially heavier recovery burden than a simple power cycle. CISA states no known public exploitation targeting this vulnerability has been reported at this time, and it is not listed on CISA KEV. For EMEA financial services, direct exposure is limited to OT estates (facilities, physical security, data-centre infrastructure) running these Logix 5000-series controllers; the risk is loss of physical process availability, not data compromise.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The advisory describes a vendor-published vulnerability with no reported exploitation, no incident, and no identified financial-sector impact; a generic "patching is required" trigger would apply to virtually every advisory and does not meet the test for citing DORA Art. 17, 18, 19, 24, 28, 29 or 30, NIS2 Art. 21(2)(d) or 23, or UK NIS 2018 duties. Clients with in-scope OT estates should nonetheless track this through their existing ICT risk and patch-management processes.

3. Technical analysis & attack chain

Vulnerability: CVE-2021-42260 — CWE-835, Loop with Unreachable Exit Condition ('Infinite Loop'). CVSS v3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H); CVSS v4.0 8.7 HIGH (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H). Availability-only impact; no confidentiality or integrity effect.

Affected products (per CISA, all firmware branches below the fixed releases)

  • ControlLogix 5580 — <34.015, <35.014, <36.013, <37.011
  • GuardLogix 5580 — <34.015, <35.014, <36.013, <37.011
  • CompactLogix 5380 — <34.015, <35.014, <36.013, <37.011
  • Compact GuardLogix 5380 — <34.015, <35.014, <36.013, <37.011
  • CompactLogix 5480 — <34.015, <35.014, <36.013, <37.011

Attack chain (confirmed steps only)

  1. Reconnaissance/access: The attacker requires network reachability to the controller. The CVSS vector is AV:N/AC:L/PR:N/UI:N — network-exploitable, low access complexity, no privileges, no user interaction. CISA's recommended practices confirm the exposure model: control devices must not be internet-accessible and should be isolated from business networks.
  2. Delivery: The attacker sends corrupt crafted data to the controller. The advisory does not specify the exact protocol or service (e.g., EtherNet/IP CIP path), so the precise delivery mechanism is unconfirmed — treat any network path terminating on the controller as in scope.
  3. Vulnerability trigger: The crafted data drives the controller firmware into a loop with an unreachable exit condition (infinite loop).
  4. Impact: The controller enters a major nonrecoverable fault (MNRF). The controller does not self-recover.
  5. Recovery burden: Safety controllers require a program download to recover; non-safety controllers require a stage 2 reset. This is the operationally significant detail — recovery is an engineering intervention, not a reboot, so a single packet can convert into sustained process downtime.

Observed impact: Denial of service / loss of controller availability. No code execution, persistence, privilege escalation, C2, lateral movement or data exfiltration is described in the advisory; the vulnerability class and CVSS vector (C:N/I:N) are consistent with availability-only impact.

Context from related advisories (same platform family, same date): CISA simultaneously republished ICSA-26-244-03 (Rockwell Automation Logix Platform, CWE-119 improper input-length validation during CIP message processing, CVSS v3.1 7.5 / v4.0 8.7, MNRF requiring power cycle, fixed in the same firmware set — 34.015 / 35.014 / 36.013 / 37.011). The identical fixed-firmware set across both advisories indicates a coordinated firmware release covering multiple DoS flaws in the Logix 5000 platform; clients patching to these versions address both. Earlier related advisories (ICSA-26-197-06, buffer overflow DoS in 5370/5570/5380/5480/5580 controllers, CVSS v3.1 8.6; ICSA-26-211-05, CIP Security CRL revocation bypass, CVSS v3.1 5.9) affect overlapping hardware and should be swept in the same exercise.

Confidence caveat: All technical detail above is single-sourced (CISA ICS advisory ICSA-26-244-05 and its machine-readable companion). No vendor PSN number, exploit proof-of-concept, or third-party technical write-up was available in the source material. The CVE identifier CVE-2021-42260 appears in the CISA advisory data but not in the advisory body text; verify the identifier mapping against the Rockwell trust centre before citing it in client-facing change records.

4. Mitigation & containment

P1 — within 24 hours

  • Inventory: Identify all ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380 and CompactLogix 5480 controllers in the OT estate (facilities management, physical access control, building management, data-centre infrastructure) and record firmware versions. Flag anything below 34.015 / 35.014 / 36.013 / 37.011 on its respective branch.
  • Exposure check: Confirm no affected controller is reachable from the internet or from general business networks. Any that are: remove the route immediately (firewall rule denying all inbound to the controller subnet except authorised engineering workstations).

P2 — within 72 hours

  • Containment for unpatchable devices: Where firmware upgrade cannot be scheduled immediately, enforce network segmentation: restrict EtherNet/IP and CIP traffic to the controller to an allow-list of authorised source hosts (engineering workstations, HMIs, SCADA servers). Block all other sources at the OT firewall/ACL.
  • Recovery readiness: Pre-stage the MNRF recovery procedure for each affected controller — program download for safety controllers, stage 2 reset for non-safety controllers — including who performs it and expected downtime, so a DoS event does not become an extended outage.

P3 — within 7 days

  • Remediation: Upgrade firmware per vendor guidance: to 34.015 or later, 35.014 or later, 36.013 or later, or 37.011 or later, matching the firmware branch in use. Schedule through the standard OT change window with a validated rollback. Note the same firmware set remediates the CWE-119 CIP message-processing DoS from ICSA-26-244-03 — patch once, close both.
  • Where upgrade is not possible: Apply Rockwell Automation's security best practices (referenced in the advisory) and maintain compensating segmentation controls.
  • Sweep related advisories: Confirm estate-wide status against ICSA-26-197-06 (5370/5570/5380/5480/5580 buffer-overflow DoS, fixed 34.014/35.013/35.016/36.011 plus boot firmware 1.072 for recovery images) and ICSA-26-211-05 (CIP Security CRL handling, fixed V38.011 / EN4TR V8.001) where those controllers are present.

5. Indicators of compromise

No indicators of compromise available in the source material. The advisory describes a vulnerability, not an exploitation campaign; no attacker infrastructure, malware samples or atomic indicators are present.

Behavioural indicators

Behaviour Where to observe Confidence
Controller enters major nonrecoverable fault (MNRF) absent a legitimate engineering action Controller status/diagnostics, RSLogix/Studio 5000 connection logs, SCADA loss-of-communication alarms High — fault state is the documented impact
Unexpected program download or stage 2 reset events on safety/non-safety controllers Engineering workstation audit logs, controller event logs Medium — recovery actions are the documented remediation path; unexpected occurrence may indicate a DoS event

6. Detection

Insufficient indicators to author detection rules. The advisory provides no malicious strings, command lines, file artefacts, registry keys, packet captures or exploit signatures — only a vulnerability description. A YARA or Sigma rule built from product names or CVE identifiers would detect reporting about the threat, not the threat itself. Monitor for the behavioural indicators in §5 (unscheduled MNRF events on affected controllers) via existing OT asset-management and SCADA alarm tooling.

7. Sources

  • CISA, Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix (ICSA-26-244-05), https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-05, 2026-09-01
  • CISA, Rockwell Automation Logix Platform (ICSA-26-244-03), https://www.cisa.gov/news-events/ics-advisories/icsa-26-244-03, 2026-09-01
  • CISA, Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix (ICSA-26-197-06), https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-06, 2026-07-16
  • CISA, Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module (ICSA-26-211-05), https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-05, 2026-07-30
  • CISA, Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT (ICSA-26-197-02), https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-02, 2026-07-16

8. Adverse Trace position

This is a genuine but bounded risk: a network-reachable, unauthenticated availability-only DoS (CVSS v3.1 7.5 HIGH / v4.0 8.7 HIGH, not on CISA KEV, no known public exploitation reported to CISA) in Rockwell Logix 5000-series controllers, whose significance lies in the MNRF recovery burden — program download or stage 2 reset rather than a reboot — rather than in any data or integrity impact. For EMEA financial services the exposure is confined to OT estates; institutions without Rockwell controllers in facilities, physical-security or data-centre infrastructure have no action beyond noting the advisory. Where controllers are present, the priority is exposure elimination (no internet or business-network reachability) followed by the coordinated firmware upgrade to 34.015/35.014/36.013/37.011, which also closes the companion CWE-119 flaw from ICSA-26-244-03. All technical detail here is single-sourced from the CISA advisory; we will monitor for a Rockwell PSN advisory, any KEV listing, or proof-of-concept code, and will reissue if exploitation is reported or the CVE-to-advisory mapping is clarified.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies