[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsJwB2qm4W7jhD6jhAGiOzdmYGreNAYJxdJU-5FUq2Ag":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":36},"2ba5ea54-7935-4b52-9bb6-37fbb02ca283","Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix","rockwell-automation-controllogix-compactlogix-compactlogix-5480-guardlogix-compa-a8e58c","View CSAF Summary The following versions of Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix are affected: ControlLogix 5580 \u003C34.015, \u003C35.014, \u003C36.013, \u003C37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) GuardLogix 5580 \u003C34.015, \u003C35.014, \u003C36.013, \u003C37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) CompactLogix 5380 \u003C34.015, \u003C35.014, \u003C36.013, \u003C37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) Compact GuardLogix 5380 \u003C34.015, \u003C35.014, \u003C36.013, \u003C37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) CompactLogix 5480 \u003C34.015, \u003C35.014, \u003C36.013, \u003C37.011 (CVE-2021-42260, CVE-2021-42260, CVE-2021-42260, CVE-2021-42260) CVSS Vendor Equipment Vulnerabilities v3 7.5 Rockwell Automation Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix Loop with Unreachable Exit Condition ('Infinite Loop') Background Critical Infrastructure Sectors: Critical Manufacturing Countries\u002FAreas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2021-42260 A potential denial of service vulnerability exists in the affected products and can be triggered via corrupt crafted data. This could result in a major nonrecoverable fault (MNRF). A program download is required to recover safety controllers. For non-safety controllers, a stage 2 reset is required to recover. View CVE Details Affected Products Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix Vendor: Rockwell Automation Product Version: Rockwell Automation ControlLogix 5580 \u003C34.015, Rockwell Automation ControlLogix 5580 \u003C35.014, Rockwell Automation ControlLogix 5580 \u003C36.013, Rockwell Automation ControlLogix 5580 \u003C37.011, Rockwell Automation GuardLogix 5580 \u003C34.015, Rockwell Automation GuardLogix 5580 \u003C35.014, Rockwell Automation GuardLogix 5580 \u003C36.013, Rockwell Automation GuardLogix 5580 \u003C37.011, Rockwell Automation CompactLogix 5380 \u003C34.015, Rockwell Automation CompactLogix 5380 \u003C35.014, Rockwell Automation CompactLogix 5380 \u003C36.013, Rockwell Automation CompactLogix 5380 \u003C37.011, Rockwell Automation Compact GuardLogix 5380 \u003C34.015, Rockwell Automation Compact GuardLogix 5380 \u003C35.014, Rockwell Automation Compact GuardLogix 5380 \u003C36.013, Rockwell Automation Compact GuardLogix 5380 \u003C37.011, Rockwell Automation CompactLogix 5480 \u003C34.015, Rockwell Automation CompactLogix 5480 \u003C35.014, Rockwell Automation CompactLogix 5480 \u003C36.013, Rockwell Automation CompactLogix 5480 \u003C37.011 Product Status: known_affected Remediations Vendor fix Rockwell Automation recommends users update to firmware version 34.015 and later. Vendor fix Rockwell Automation recommends users update to firmware version 35.014 and later. Vendor fix Rockwell Automation recommends users update to firmware version 36.013 and later. Vendor fix Rockwell Automation recommends users update to firmware version 37.011 and later. Mitigation Customers using the affected software who are not able to upgrade to one of the corrected versions should use Rockwell Automation's security best practices. Relevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') Metrics CVSS Version Base Score Base Severity Vector String 3.1 7.5 HIGH CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:N\u002FA:H 4.0 8.7 HIGH CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:N\u002FVI:N\u002FVA:H\u002FSC:N\u002FSI:N\u002FSA:N Acknowledgments Rockwell Automation reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https:\u002F\u002Fwww.cisa.gov\u002Fnotification) and this Privacy & Use policy (https:\u002F\u002Fwww.cisa.gov\u002Fprivacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices and\u002For systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov\u002Fics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov\u002Fics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. CISA also recommends users take the following measures to protect themselves from social engineering attacks: Do not click web links or open attachments in unsolicited email messages. Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. Revision History Initial Release Date: 2026-09-01 Date Revision Summary 2026-09-01 1 Initial republication of Rockwell Automation advisory Legal Notice and Terms of Use","Rockwell Automation has identified a denial-of-service vulnerability (CVE-2021-42260) affecting multiple ControlLogix, CompactLogix, GuardLogix, and Compact GuardLogix products. Exploitation can lead to a major nonrecoverable fault, requiring a program download or stage 2 reset to recover. Rockwell Automation recommends updating firmware to specific versions to remediate.","Rockwell Automation industrial controllers vulnerable to denial of service via crafted data.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-244-05",null,"2026-09-01T12:00:00+00:00","2026-09-01T16:00:19.281377+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Rockwell Automation","vendor",{"name":21,"type":22},"ControlLogix","product",{"name":24,"type":22},"CompactLogix",{"name":26,"type":22},"GuardLogix",{"name":28,"type":22},"Compact GuardLogix",{"name":30,"type":31},"ICS","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":12,"name":34,"slug":35},"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":32,"icon":12,"name":34,"slug":35},{"category":40},{"id":41,"icon":12,"name":42,"slug":43},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":45},{"id":46,"icon":12,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"cve","CVE-2021-42260","Denial of service vulnerability in Rockwell Automation industrial controllers.",[18,21,24],{"controls":56,"vendors":143},[57,86,114],{"slug":58,"name":59,"problem":60,"products":61},"patch-management","Automated patch management","Known holes get closed in days, not months.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":87,"name":88,"problem":89,"products":90},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":109,"url":112,"description":113},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":115,"name":116,"problem":117,"products":118},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":159},"rockwell-automation-plc-vulnerability-enables-denial-of-service-on-industrial-control-systems","Rockwell Automation PLC Vulnerability Enables Denial-of-Service on Industrial Control Systems","A denial-of-service vulnerability (CVE-2021-42260) in multiple Rockwell Automation ControlLogix and GuardLogix product lines allows attackers to trigger a major nonrecoverable fault, effectively halting industrial operations until manual recovery steps are performed. This is particularly dangerous in operational technology (OT) environments where availability is critical to safety and production continuity. The fact that recovery requires a program download or stage 2 reset means even a brief exploitation event can result in significant downtime and potential physical-world consequences. Unpatched industrial control systems remain one of the highest-risk attack surfaces in critical infrastructure, as firmware updates are often delayed due to operational constraints.",[149,150,151,152,153,154,155,156,157,158],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-82: Guide to ICS Security","NIST SI-2: Flaw Remediation","NIST SA-10: Developer Configuration Management","IEC 62443-2-1: Security Management System for IACS","IEC 62443-3-3: System Security Requirements and Security Levels","NERC CIP-007-6: Systems Security Management (patch management)","CISA ICS Advisory ICSA-21-299-01",{}]