CVE-2026-11317: Rockwell Automation Logix 5370 and 5570 Controllers Vulnerable To Denial of Service Via CIP

Synopsis

A denial-of-service vulnerability exists in Rockwell Automation CompactLogix and ControlLogix controllers (Logix 5370 and 5570 families). An unauthenticated attacker reachable over the network can send a specially crafted CIP (Common Industrial Protocol) message that triggers a major nonrecoverable fault, taking the controller offline and requiring a full program download to recover. Successful exploitation disrupts the affected industrial control system with no confidentiality or integrity impact, but complete availability loss on the targeted device. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream fix versions are published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the controller over the network, as the CIP message is delivered remotely; AV:N confirms over-the-network exposure.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to send the malicious CIP message; PR:N confirms authentication is absent as a barrier.

• Victim interactionNot required

  No user or operator action is needed to trigger the fault; the crafted packet alone is sufficient, as indicated by UI:N.

• Attack complexityDetail

  The exploit is reliable and condition-free under normal network access; AC:L indicates no race conditions or special environmental factors are required.

Blast Radius

• The targeted controller enters a major nonrecoverable fault state and stops executing its control program, halting any industrial process it governs.
• Recovery requires a full program download to the device, meaning downtime is extended beyond a simple reboot and requires operator intervention.
• Devices with lower available memory are more susceptible, meaning the effective blast radius can vary across a fleet of otherwise identically configured controllers.
• Physical-process disruption is the primary outcome; there is no attacker read or write access to data, so confidentiality and data integrity are unaffected.