Rockwell Automation: DoS Vulnerability in ControlLogix and CompactLogix Controllers

A remotely exploitable vulnerability can place several Rockwell Automation industrial controllers into a fault state, disrupting normal operations. Tracked as CVE-2021-42260, the issue affects specific versions of the ControlLogix, GuardLogix, and CompactLogix product families.

CISA published the advisory on September 1, 2026, republishing the manufacturer’s advisory. The vulnerability is rated high severity and can be triggered without authentication or user interaction by sending specially crafted, malformed data.

The primary impact is on availability: a successful attack can cause a Major Non-Recoverable Fault, or MNRF. Recovery is not immediate and depends on whether the device performs safety functions.

Five controller lines affected

Rockwell Automation classifies five controller families as vulnerable. The update thresholds are the same for all models, but they must be interpreted according to the installed firmware branch.

Product	Vulnerable versions
ControlLogix 5580	earlier than 34.015, 35.014, 36.013, and 37.011
GuardLogix 5580	earlier than 34.015, 35.014, 36.013, and 37.011
CompactLogix 5380	earlier than 34.015, 35.014, 36.013, and 37.011
Compact GuardLogix 5380	earlier than 34.015, 35.014, 36.013, and 37.011
CompactLogix 5480	earlier than 34.015, 35.014, 36.013, and 37.011

In operational terms, users on the 34.x branch must install at least release 34.015. For subsequent branches, the first versions above the vulnerable threshold are 35.014, 36.013, and 37.011, respectively.

All of the listed products are classified as known_affected, meaning that exposure is not merely inferred from shared components. OT administrators should verify the model, the controller’s role, and the firmware version actually in use.

The devices are used in the critical manufacturing sector and are deployed worldwide. Rockwell Automation is headquartered in the United States, but the potential impact is not limited to North American facilities.

An infinite loop drives the device into a fault state

CVE-2021-42260 is associated with CWE-835, known as “Loop with Unreachable Exit Condition.” Essentially, the software enters a loop that it cannot exit because the required exit condition can never be reached.

The abnormal condition is triggered by providing the controller with malformed, intentionally crafted data. No further details have been disclosed about the data format, the protocol involved, or the precise sequence required to trigger the flaw.

The result can be a Major Non-Recoverable Fault, a serious error from which the controller cannot automatically return to normal operation. In an industrial environment, this can make the controlled function unavailable and require technical intervention.

The recovery process depends on the device:

• safety controllers require the program to be downloaded again;
• non-safety controllers require a stage 2 reset.

This distinction is important when planning the response. On systems dedicated to functional safety, recovery must follow internal validation and recommissioning procedures; the fault should not be treated as a simple restart.

Remote attack with no credentials and low complexity

The CVSS 3.1 assessment assigns the vulnerability a score of 7.5 out of 10, with HIGH severity:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The vector describes an attack that can be carried out over the network, with low complexity and no prior privileges. No operator action is required.

The impact is limited to availability. The confidentiality and integrity metrics are zero: the advisory does not describe information theft, modification of industrial programs, or manipulation of process data. The documented risk is controller disruption.

Under CVSS 4.0, the score rises to 8.7, again with high severity:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

This assessment likewise confirms that the attack requires no authentication, user interaction, or additional conditions. However, this does not mean that every controller is externally reachable: actual exposure depends on the network architecture, firewalls, and facility segmentation.

No known public exploitation and no KEV deadline

The vulnerability was reported to CISA by Rockwell Automation. At the time of the advisory’s publication, there were no reports of known public exploitation specifically targeting CVE-2021-42260.

No specific indicators of compromise were provided, such as IP addresses, traffic signatures, or log sequences to search for. Security teams can nevertheless monitor for unexpected MNRF faults, anomalous traffic to controllers, and communication attempts originating from unauthorized network segments.

The advisory does not indicate that the vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalog. Consequently, no KEV remediation deadline is listed. Publication by the U.S. agency should therefore not be confused with confirmation of active exploitation.

The timeline lists September 1, 2026 as the initial release date. Revision 1, marked with the same date, consists of the republication of the Rockwell Automation advisory.

Updating and segmentation are the primary defenses

The priority measure is to install the correct releases provided by the manufacturer, bringing each controller at least to the threshold specified for its firmware branch. Before proceeding, organizations should assess the impact on the industrial process, maintenance windows, and functional safety.

In particular, organizations should:

1. inventory the ControlLogix and CompactLogix models deployed across OT networks;
2. verify the firmware branch and version of each device;
3. schedule updates to the correct releases;
4. prepare backups and program recovery procedures;
5. verify proper operation after installation.

Where an update cannot be applied immediately, CISA recommends reducing exposure. Controllers must not be directly accessible from the Internet, and OT networks should be separated from corporate networks using firewalls and segmentation.

When remote access is essential, it should be provided through up-to-date, properly secured VPNs. A VPN does not compensate for a compromised endpoint, however: organizations must also review the devices authorized to connect to the industrial environment.

Communications should also be restricted to the systems and protocols that are strictly necessary, following a defense-in-depth model. CISA also refers to the technical document ICS-TIP-12-146-01B for detecting and mitigating intrusions targeting control systems.

Recommendations addressing phishing and social engineering remain complementary measures: avoiding unsolicited links and attachments reduces the likelihood that an attacker will compromise a workstation and subsequently reach the OT network. Suspicious activity should be handled according to internal procedures and reported to CISA to support correlation with other events.