CVE-2026-9307 - Rockwell Automation CompactLogix 5370 Controllers

Back Back to CVE browser

MEDIUM

Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities

Published Jun 16, 2026

6.3

MEDIUM

CVSS 4.0

EPSS 0.45%

Description

A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs on the diagnostics webpage, which are accessible to any unauthenticated user on the network. This information can be leveraged by an attacker to construct malicious packets, leading to Denial-of-Service.

Affected products

Vendor Rockwell Automation Product CompactLogix 5370 Default
unaffected
- Version
  V36
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Rockwell Automation

CompactLogix 5370

unaffected

Version	Status	Constraints
V36	affected	-

Remediation

Vendor solution

V38.011 https://compatibility.rockwellautomation.com/Pages/MultiProductFindDownloads.aspx

Weaknesses (1)

CWE-497

References (1)

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1776.html

Link	Providers	Tags
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1776.html

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Rockwell

Published Jun 16, 2026

Updated Jun 16, 2026

Reserved May 22, 2026

Link CVE-2026-9307

CISA Vulnrichment

Updated Jun 16, 2026

NVD

Status Awaiting Analysis

Modified Jun 17, 2026

Link CVE-2026-9307

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-9307