CVE-2026-9637: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer in Rockwell Automation CompactLogix® 5380 / ControlLogix® 5580

This vulnerability (CVE-2026-9637) involves improper restriction of operations within the bounds of a memory buffer (CWE-119) in Rockwell Automation CompactLogix® 5380 and ControlLogix® 5580. Specifically, the affected Logix platforms do not properly validate input length during Common Industrial Protocol (CIP) message processing. This flaw can lead to a denial-of-service condition characterized by a major nonrecoverable fault (MNRF) that forces the device to be power cycled to restore functionality. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation results in a denial-of-service condition causing a major nonrecoverable fault on the affected devices. This fault requires a manual power cycle to recover, potentially causing operational disruption in industrial control environments using these Rockwell Automation platforms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, consider limiting network exposure of affected devices and monitoring for anomalous CIP traffic targeting these platforms.