CVE-2026-9637
A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover
Scoring
- Severity
- HIGH
- CVSS base score
- 8.7
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- EPSS probability
- 0.31%
- CWE
- CWE-119
- Published
- 2026-09-01
- Last modified
- 2026-09-01
Affected products
- Rockwell Automation CompactLogix® 5380 / ControlLogix® 5580
Weakness type
Related vulnerabilities
- CVE-2026-87933 — DaveGamble cJSON cJSON_Utils.c cJSONUtils_MergePatch use after free
- CVE-2026-87931 — Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow
- CVE-2026-87489 — Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-87444 — Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...
- CVE-2026-86716 — Cesanta mJS mjs_tok.c skip_spaces_and_comments heap-based overflow
- CVE-2026-86514 — vgmstream txth-txtp txth.c sscanf stack-based overflow
- CVE-2026-86510 — D-Link DIR-822A L2TP Control Message tunnel_set_params out-of-bounds write
- CVE-2026-86509 — D-Link DIR-895L udhcpcd serverpacket.c sendACK stack-based overflow