PT-2026-84236 · Rockwell Automation · Logix
CVE-2026-9637
·
Published
2026-09-01
·
Updated
2026-09-01
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Logix platforms (affected versions not specified)
Description
A denial-of-service issue exists due to improper validation of input length during the processing of Common Industrial Protocol (CIP) messages. An unauthenticated remote attacker can exploit this buffer overflow by sending malformed CIP messages, triggering a major nonrecoverable fault (MNRF), which is a critical system failure that requires a full power cycle to recover.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Implement runtime segmentation to limit the potential impact of network-based attacks.
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Logix