{"id":"CVE-2026-9637","state":"PUBLISHED","title":"CompactLogix® 5380 / ControlLogix® 5580 - Multiple Vulnerabilities","description":"A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover","publishedAt":"2026-09-01T13:28:26.239Z","updatedAt":"2026-09-01T15:44:01.789Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"Rockwell"},"assigner":"Rockwell","products":["Rockwell Automation CompactLogix® 5380 / ControlLogix® 5580"],"affected":[{"vendor":"Rockwell Automation","product":"CompactLogix® 5380 / ControlLogix® 5580","defaultStatus":"unaffected","versions":[{"version":"V33 and prior, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012","status":"affected"}]}],"references":["https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1792.html"],"weaknesses":["CWE-119"],"ingestedAt":"2026-10-29T20:13:52.441Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/9xxx/CVE-2026-9637.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-9637","state":"PUBLISHED","datePublished":"2026-09-01T13:28:26.239Z","dateUpdated":"2026-09-01T15:44:01.789Z","assignerShortName":"Rockwell","assignerOrgId":"b73dd486-f505-4403-b634-40b078b177f0","dateReserved":"2026-05-26T18:11:06.053Z"},"containers":{"cna":{"title":"CompactLogix® 5380 / ControlLogix® 5580 - Multiple Vulnerabilities","descriptions":[{"lang":"en","value":"A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover"}],"affected":[{"vendor":"Rockwell Automation","product":"CompactLogix® 5380 / ControlLogix® 5580","defaultStatus":"unaffected","versions":[{"version":"V33 and prior, V34.011-V34.014, V35.011-V35.013, V36.011-V36.012","status":"affected"}]}],"references":[{"url":"https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1792.html"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":8.7,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-119","lang":"en","description":"CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer","type":"CWE"}]}],"providerMetadata":{"shortName":"Rockwell","orgId":"b73dd486-f505-4403-b634-40b078b177f0","dateUpdated":"2026-09-01T13:28:26.239Z"},"cpeApplicability":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rockwell_automation:compactlogix_5380_controllogix_5580:v33_and_prior_v34.011-v34.014_v35.011-v35.013_v36.011-v36.012:*:*:*:*:*:*:*"}]}]}],"source":{"advisory":"SD1792","discovery":"INTERNAL"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-01T15:43:54.681397Z","id":"CVE-2026-9637","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-01T15:44:01.789Z"}}]}}}