Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module: 1 CVE, Medium 5.9
Summary
CISA reports 1 vulnerability in Rockwell Automation ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380 and 1 more. Weakness type: Improper Check for Certificate Revocation. Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. Highest CVSS v3 score: 5.9 (Medium), exploitable over the network.
At a glance
- Vendor
- Rockwell Automation
- Products
- ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380, 1756-EN4TR
- CVEs
- CVE-2026-9636
- Highest CVSS v3
- 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing
- Deployed
- Worldwide
- Vendor HQ
- United States
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-9636 | Improper Check for Certificate Revocation | 5.9 | – | No | A security issue exists within CompactLogix 5380, ControlLogix 5580, and EN4TR communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a… |
Affected products (6)
- Rockwell Automation ControlLogix 5580: >=V36|<=V37
- Rockwell Automation CompactLogix 5380: >=V36|<=V37
- Rockwell Automation GuardLogix 5580: >=V36|<=V37
- Rockwell Automation Compact GuardLogix 5380: >=V36|<=V37
- Rockwell Automation 1756-EN4TR: V6.001
- Rockwell Automation 1756-EN4TR: V7.001
Vendor fixes and mitigations (from advisory)
- Vendor Fix: Rockwell Automation recommend users update to the following versions: ControlLogix 5580: Update to V38.011
- Vendor Fix: CompactLogix 5380: Update to V38.011
- Vendor Fix: GuardLogix 5580: Update to V38.011
- Vendor Fix: Compact GuardLogix 5380: Update to V38.011
- Vendor Fix: 1756-EN4TR: Update to V8.001
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.