Unauthenticated network access to CIP Connection IDs exposed via the web interface creates a viable path to disrupting industrial control systems.
Summary
- CISA has published an advisory covering two vulnerabilities in Rockwell Automation CompactLogix 5370 L1, L2, and L3 controllers running firmware below V38.011.
- CVE-2025-11694 (CVSS v3.1: 7.5 HIGH) allows an unauthenticated attacker to exploit missing sequence number and source IP validation in the CIP protocol to trigger denial-of-service conditions.
- CVE-2026-9307 (CVSS v3.1: 5.3 MEDIUM) exposes CIP Connection IDs on the controller’s diagnostics web page to any unauthenticated user on the network, providing the information needed to craft malicious packets.
- No known public exploitation of these vulnerabilities has been reported to CISA at this time.
- The fix is straightforward: update affected controllers to firmware version V38.011.
What Has Been Disclosed
CISA published an advisory on 16 June 2026 republishing Rockwell Automation’s own Security Advisory SD1776. It covers two distinct but related vulnerabilities affecting the CompactLogix 5370 L1, L2, and L3 programmable logic controller families — equipment deployed widely across critical manufacturing environments worldwide.
The First Vulnerability: Protocol-Level Weakness
CVE-2025-11694 carries a CVSS v3.1 base score of 7.5 (HIGH) and 8.7 under CVSS v4.0. The flaw sits within the CIP protocol implementation on affected 1769 CompactLogix controllers. Specifically, the controllers fail to validate sequence numbers or source IP addresses on incoming CIP traffic. Because CIP Connection IDs are visible on the controller’s web interface, an attacker who can reach the device on the network can abuse those identifiers to send crafted packets that trigger a minor fault and place the controller in a denial-of-service condition. No authentication is required, and the attack vector is network-based with low complexity.
The Second Vulnerability: Information Disclosure That Enables Attack
CVE-2026-9307 scores 5.3 (MEDIUM) under CVSS v3.1 and 6.3 under CVSS v4.0. The issue is that the controller’s built-in web server presents CIP Connection IDs on its diagnostics page without requiring any authentication. On its own this is an information disclosure issue, but it is directly relevant to CVE-2025-11694 — an attacker first reads the Connection IDs from the web page, then uses that information to construct the malicious CIP packets described above. The two vulnerabilities are effectively complementary. Both were reported to CISA by Tyler Lentz of Idaho National Laboratory.
Scope and Deployment Context
The affected product lines — CompactLogix 5370 L1, L2, and L3 — are positioned in the critical manufacturing sector and are deployed globally. All versions below V38.011 are listed as known-affected. CISA notes no public exploitation has been reported at the time of the advisory’s release, which provides a useful but not unlimited window for remediation.
Remediation
Rockwell Automation’s recommended action is to update affected controllers to firmware version V38.011. Update packages are available through Rockwell’s compatibility and downloads portal. Organisations that cannot immediately apply the firmware update should implement the network isolation and access controls described in the advisory as interim mitigations.
Why it matters
For CISOs responsible for operational technology environments, these vulnerabilities represent a pattern that warrants attention beyond this single product: a web-based diagnostics interface exposes operational data to unauthenticated users, and a separate protocol-layer weakness turns that exposed data into a usable attack primitive. The combined effect is that any actor with network access to an unpatched CompactLogix controller can collect the information they need and then disrupt the controller — all without credentials. In critical manufacturing contexts, even a minor fault that halts a controller can cascade into production downtime or, depending on the process, safety implications. The CVSS v4.0 score of 8.7 on the protocol flaw reflects the practical severity more accurately than the v3.1 score alone. The absence of known exploitation is encouraging, but these are not obscure research-grade vulnerabilities; the attack chain is straightforward enough that it should be treated as an active risk management item rather than a deferred patch cycle task.
What to do now
- Identify all CompactLogix 5370 L1, L2, and L3 controllers in your environment running firmware versions below V38.011 and prioritise them for update.
- Update affected controllers to firmware version V38.011, available via Rockwell Automation’s compatibility and downloads portal.
- Ensure CompactLogix controllers and other ICS devices are not directly accessible from the internet, and isolate control system networks from corporate business networks using firewalls.
- Where remote access to these controllers is necessary, require access through a VPN and ensure the VPN solution itself is kept current.
- Review whether the diagnostics web interface on affected controllers is accessible to users beyond those with an operational need, and restrict access accordingly as an interim measure.
- Consult Rockwell Automation Security Advisory SD1776 for vendor-specific guidance, and report any suspected malicious activity targeting these systems to CISA.
