CISA Flags High-Severity DoS Flaw Across Rockwell Logix Platform
Safety controller recovery requires a full program redownload, not a reboot, not a power cycle, a complete reflash with the project file.
TL;DR
CISA published an advisory for CVE-2021-42260, a high-severity denial-of-service vulnerability in Rockwell Automation ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380, and CompactLogix 5480 controllers. Corrupt crafted data can trigger a major nonrecoverable fault (MNRF). Safety controllers require a full program download to recover; non-safety controllers need a stage 2 reset. Rockwell recommends updating to firmware versions 34.015, 35.014, 36.013, or 37.011 and later. The advisory covers firmware lines 34 through 37 across all five current-generation Logix families.
CVE-2021-42260 is an infinite-loop condition (CWE-835) triggered by corrupt crafted data. CVSS v3.1 puts it at 7.5 (HIGH); CVSS v4 at 8.7. The vector is network-exploitable, low complexity, no privileges required, no user interaction. The impact is purely availability: the controller faults and stops.
The recovery distinction matters. For safety controllers (GuardLogix 5580 and Compact GuardLogix 5380) a major nonrecoverable fault means the engineering team has to redownload the complete project file. That's not a quick power cycle; it's a deliberate reflash requiring the right workstation, the current project file, and someone who knows the program. For non-safety controllers, a stage 2 reset is the path back. Either way, the controller is dead until someone physically or remotely intervenes.
This advisory is effectively a full-platform notice. It covers all five Logix 5000-series families (ControlLogix, GuardLogix, CompactLogix, Compact GuardLogix, and CompactLogix 5480) across four firmware lines (v34, v35, v36, v37). The affected range is everything below the patched versions: 34.015, 35.014, 36.013, and 37.011. Rockwell ships a lot of controllers on these firmware lines, and the advisory is silent on how many installed bases remain unpatched.
Rockwell reported the vulnerability to CISA and has published firmware updates. The advisory also points users who can't upgrade immediately to Rockwell's security best practices. CISA's standard ICS mitigation language (minimize network exposure, isolate control system networks behind firewalls, use VPNs for remote access) accompanies the advisory. No known public exploitation has been reported to CISA at this time, per the advisory's revision history.
Published ·Deep Fathom