CVE-2026-9307
Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities
- State
- Published
- Severity
- 6.3 Medium
- Published
- Jun 16, 2026
- Updated
- Jun 16, 2026
- Reserved
- May 22, 2026
Description
A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs on the diagnostics webpage, which are accessible to any unauthenticated user on the network. This information can be leveraged by an attacker to construct malicious packets, leading to Denial-of-Service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.3 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | Rockwell |
Weaknesses
- CWE-497 Exposure of sensitive system information to an unauthorized control sphere
Affected Products
| Product | Versions |
|---|---|
CompactLogix 5370Rockwell Automation |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.