As reported by CISA in advisory ICSA-26-244-05, a denial-of-service vulnerability (CVE-2021-42260) affects multiple Rockwell Automation programmable logic controller (PLC) families, including ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380, and CompactLogix 5480. The flaw carries a CVSS v3 score of 7.5 (High) and enables an attacker to induce a major nonrecoverable fault (MNRF) via crafted data sent to the controller.
Vulnerability Details
| CVE | CVSS | Type | Patch Status |
|---|---|---|---|
| CVE-2021-42260 | 7.5 (High) | Infinite Loop / DoS (CWE-835) | Firmware updates available |
Affected Firmware: Versions prior to 34.015, 35.014, 36.013, and 37.011 across all five product families. Patches exist in firmware releases at or above those thresholds.
Active Exploitation: No confirmed in-the-wild exploitation has been publicly documented at the time of this advisory's release, but the vulnerability class is well-understood and trivially weaponizable by anyone with network access to the controller's EtherNet/IP interface.
Why This Matters
What elevates this advisory beyond a routine patch notification is the recovery burden. When the MNRF condition is triggered, safety controllers require a full program download to restore operation, and non-safety controllers require a stage 2 reset. In both cases, this means physical or local access to the controller, engineering workstation availability, and — critically — production downtime. In a critical manufacturing environment, that translates to measurable financial loss and potential safety implications if the affected controller manages a safety-instrumented function.
The attack itself is lightweight; the recovery is not. That asymmetry is what makes this vulnerability operationally significant despite a 'mere' 7.5 CVSS score.
The fact that CVE-2021-42260 — originally disclosed in 2021 — is being surfaced again in a 2026 advisory underscores a chronic problem in OT environments: long patching cycles. Many industrial sites operate these controllers on firmware that is years out of date because production windows are scarce and firmware upgrades carry their own risk of process disruption. Attackers know this.
Who Is at Risk
Shield53 Recommendations
Immediate Actions
- Inventory and prioritize: Identify all ControlLogix 5580, GuardLogix 5580, CompactLogix 5380/5480, and Compact GuardLogix 5380 controllers in your environment. Record current firmware versions against the patched thresholds (34.015, 35.014, 36.013, 37.011).
- Patch safety controllers first: GuardLogix and Compact GuardLogix should take top priority given the safety-system impact. Schedule firmware upgrades during the next available maintenance window.
- Segment EtherNet/IP traffic: Ensure CIP protocol traffic on TCP/UDP 44818 and 2222 is restricted to known engineering workstations and supervisory devices only. No controller should be reachable from corporate or internet-facing networks.
- Deploy network monitoring: Use an OT-aware IDS/IPS (such as Claroty, Nozomi, or Dragos) to detect anomalous CIP traffic patterns that could indicate crafted packet injection attempts.
Longer-Term Hardening
- Establish a quarterly firmware review cadence for all Rockwell controllers, not just those flagged in advisories
- Implement Rockwell's FactoryTalk Policy Manager for CIP security and controller access control where supported
- Maintain offline backups of all controller projects (.ACD files) so program-download recovery is possible without engineering delays
- Document and rehearse the MNRF recovery procedure for each critical controller so operators are not learning it during an incident
The deeper lesson here is that OT vulnerability management cannot follow IT timelines. A five-year-old CVE still appearing in advisories is not an anomaly — it is the default state of many industrial environments. Defenders need asset inventories that are actually current, segmentation that is actually enforced, and recovery procedures that have actually been tested.
