Rockwell PLCs Can Be Knocked Offline With One Malformed Network Packet
- The Mess: Rockwell patched a high-severity flaw in ControlLogix 5580 and CompactLogix 5380 controllers that mishandles the length of CIP messages. One malformed packet can push an affected controller into a Major Nonrecoverable Fault.
- The Damage: The attack requires no authentication or user interaction and can take an industrial controller offline until someone performs a power cycle.
- The Fix: Update affected Logix firmware to the corrected versions and keep PLCs off the public internet behind properly segmented industrial networks.
This is not a workstation bug.
It is a PLC problem.
Rockwell Automation disclosed CVE-2026-9637 for its Logix Platform after researchers identified improper input-length validation during CIP message processing.
The vulnerability carries a CVSS 4.0 score of 8.7.
More importantly, the attack path is brutally simple.
Network access.
A malformed CIP message.
No credentials.
No user interaction.
Then the controller can hit a Major Nonrecoverable Fault.
Recovery requires a power cycle.
The Packet Is Enough
CIP — the Common Industrial Protocol — is heavily used in industrial automation networks.
Rockwell’s affected Logix controllers process these messages as part of normal industrial communication.
CVE-2026-9637 exists because the platform does not properly validate the length of certain input during CIP processing.
An attacker who can reach the vulnerable controller can send specially crafted network traffic.
The result is not remote code execution.
It is arguably more boring — and potentially more disruptive.
The controller stops doing its job.
Production stops with it.
This Is an OT Problem, Not Just Another CVE
On a normal server, a denial-of-service vulnerability can mean a service restart.
In an industrial environment, the consequences can be physical.
A controller may be responsible for manufacturing equipment, conveyors, pumps, robotic systems, process controls or safety-related operations.
If that controller enters a nonrecoverable fault state, someone may have to physically intervene.
That changes the cost of a “simple DoS.”
An attacker does not need administrator privileges if the network architecture already gives them a path to the PLC.
And industrial networks are not always as isolated as their owners assume.
Remote maintenance, engineering workstations, vendor access, VPNs and poorly segmented IT/OT connections can create unexpected routes into control systems.
No Password Required
CVE-2026-9637 has an ugly combination of characteristics:
Network reachable.
Low attack complexity.
No privileges.
No user interaction.
High availability impact.
That is exactly the kind of vulnerability that should make OT security teams check network exposure before anything else.
An attacker does not have to compromise the PLC’s operating system.
They just need a way to talk to it.
The Affected Firmware Is Old — But Still Everywhere
Rockwell lists affected firmware across several Logix generations, including versions through V36.012 depending on the platform.
Corrected firmware is available.
Rockwell also continues to recommend its standard industrial security practices, including keeping controllers away from direct internet exposure and applying network segmentation and other defensive controls.
That advice sounds obvious.
It isn’t.
Industrial devices continue to appear in environments where network boundaries are far weaker than they should be.
A PLC should not be sitting on the internet waiting for somebody to discover its IP address.
One Important Correction
There is a wrinkle worth mentioning.
Rockwell’s advisory currently contains an exploitation indicator that suggests the vulnerability may have been exploited. However, the rest of the advisory says otherwise, and CISA’s own advisory says the agency is not aware of exploitation.
So this is not an active-exploitation story.
At least not yet.
That distinction matters.
What we do have is a fresh, remotely triggerable, high-severity DoS vulnerability affecting industrial controllers where a successful attack can require physical intervention to restore operation.
That’s already bad enough.
Bugstoday Opinion
Industrial security keeps teaching the same lesson.
You don’t always need root.
You don’t always need RCE.
You don’t even need to steal anything.
Sometimes all you need is a network path and a packet that the PLC wasn’t expecting.
And unlike a crashed web server, a crashed controller can stop something that moves, pumps, heats, cuts or manufactures something.
Bugstoday verdict: If a PLC can be knocked into a nonrecoverable fault from the network, the network around that PLC is part of the security boundary. Treat it that way.
Sources:
- Rockwell Automation — SD1792
- CISA — ICSA-26-244-03
- NVD — CVE-2026-9637
- CVE.org — CVE-2026-9637
