The Cybersecurity and Infrastructure Security Agency (CISA) has published an urgent industrial control systems advisory, ICSA-26-253-03, highlighting critical vulnerabilities affecting Rockwell Automation Logix programmable logic controllers (PLCs) and associated 1756 ControlLogix communications bridge modules.
Rockwell Automation PLCs serve as the hardware backbone for industrial manufacturing lines, automotive assembly plants, pharmaceutical batch synthesizers, and water treatment facilities worldwide. The disclosed defects enable an attacker with network access to the industrial automation subnet to manipulate controller state, alter active ladder logic, and trigger unrecoverable controller major non-recoverable faults (MNRF).
Vulnerability Mechanics: CIP Protocol Packet Injection
The core vulnerability, tracked as CVE-2026-58190, carries a CVSS v3.1 base score of 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Categorized under CWE-287: Improper Authentication and CWE-20: Improper Input Validation, the flaw affects the EtherNet/IP stack implementation handling the Common Industrial Protocol (CIP).
In default legacy installations, CIP communication lacks mandatory cryptographic session signing. Attackers can exploit parser deficiencies in the 1756-ENBT and 1756-EN2T communication modules:
- Unauthenticated CIP Route Execution: The adversary broadcasts crafted CIP encapsulation packets on TCP/UDP port 44818 targeting the controller backplane.
- Buffer Manipulation & State Injection: The Ethernet interface module parses the command without validating administrative session rights, forwarding modified assembly tags directly to the Logix processor core.
- PLC Logic Modification or Shutdown: The attacker can force output coils on or off, overwrite setpoint registers, or force the controller into "STOP" mode, halting physical machinery instantly.
When an attacker can inject CIP commands into an industrial controller, the boundary between the digital domain and physical machinery dissolves. Motor speeds, temperature limits, and safety trip valves can be manipulated in real time.
Impacted Hardware & Firmware Matrix
| Controller / Module Line | Impacted Firmware Versions | Patched Firmware Version | Remediation Status |
|---|---|---|---|
| ControlLogix 5580 & GuardLogix 5580 | v32.011 through v35.011 | v35.013 / v36.011 | Firmware Patch Available |
| 1756-EN2T / 1756-EN3TR Modules | v5.008 through v11.002 | v11.004 | Firmware Patch Available |
| CompactLogix 5380 / 5480 | v33.011 through v34.012 | v34.014 / v35.011 | Firmware Patch Available |
Recommended Industrial Hardening Checklist
Plant engineers, automation technicians, and industrial cybersecurity teams should implement the following protective measures:
- Enable CIP Security: Where supported, configure CIP Security to enforce TLS and DTLS cryptographic verification for all EtherNet/IP communications between engineering workstations, HMIs, and Logix controllers.
- Physical Controller Keyswitch to RUN: Turn the physical mode selector keyswitch on all production Logix controller faceplates from "REM" (Remote) to "RUN". In RUN mode, external network commands cannot alter controller logic or download new programs.
- Block Port 44818 at Industrial Perimeter: Ensure that TCP/UDP port 44818 (EtherNet/IP) and port 2222 (EtherNet/IP I/O) are blocked at the perimeter firewall and cannot be traversed from enterprise IT or external networks.
- Deploy FactoryTalk AssetCentre Audit Logging: Maintain continuous version tracking and audit logging for all PLC project file modifications and unauthorized connection attempts.
