CIP Security Certificate Bypass in CompactLogix 5380

Executive Summary

CVE-2026-9636 is a security vulnerability affecting Rockwell Automation's CompactLogix 5380, ControlLogix 5580, GuardLogix 5580, Compact GuardLogix 5380, and 1756-EN4 communication modules. The issue involves improper handling of Certificate Revocation Lists (CRLs). Specifically, the controller fails to properly reject certificates that are signed by an intermediate certificate that has been revoked via a CRL.

This flaw could allow a network-based attacker to establish a connection using a certificate that should be untrusted. By doing so, the attacker may bypass CIP Security protections, which are designed to ensure secure communication in industrial control systems.

• Affected firmware versions include V36-V37 for ControlLogix and CompactLogix controllers and V6.001-V8.001 for the 1756-EN4TR module.
• The vulnerability only impacts users who have enabled the CRL feature and are using intermediary certificates. Those who do not use this feature are not affected.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires verifying whether your Rockwell Automation controllers or communication modules are using the CRL feature with intermediary certificates and whether they are running affected firmware versions.

• Check the firmware version of your ControlLogix 5580, CompactLogix 5380, GuardLogix 5580, Compact GuardLogix 5380, or 1756-EN4/EN4TR modules. The vulnerability affects firmware versions V36-V37 for controllers and V6.001-V8.001 for the 1756-EN4TR module.
• Verify if the CRL feature is enabled on your devices. This vulnerability only impacts systems where the CRL feature is active and intermediary certificates are in use.
• Use Rockwell Automation's Studio 5000 or other supported configuration tools to inspect the certificate configuration and CRL settings. Look for signs of revoked intermediate certificates that may not be properly rejected.
• Monitor network traffic for unexpected CIP Security connections. An attacker exploiting this vulnerability may establish connections using certificates that should be rejected due to revocation.

Specific commands or tools for detection are not provided in the context, but you may refer to Rockwell Automation's documentation or support for guidance on checking firmware versions and CRL configurations.

Useful 0 Not Useful 0

Impact Analysis

If you are using the affected Rockwell Automation devices with the CRL feature enabled and intermediary certificates, this vulnerability could have several impacts.

• A network-based attacker could bypass CIP Security protections, allowing them to establish unauthorized connections to your industrial control systems.
• This could lead to unauthorized access, manipulation, or disruption of critical industrial processes, potentially causing operational downtime or safety risks.
• The attacker might exploit this flaw to gain a foothold in your network, which could be used for further attacks or data exfiltration.

The vulnerability is rated with a CVSS 4.0 base score of 8.2, indicating a significant risk, particularly in environments where secure communication is critical.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with several common standards and regulations, depending on the industry and the specific use of the affected devices.

• GDPR: If the affected systems process or store personal data of EU citizens, a breach resulting from this vulnerability could lead to unauthorized access or exposure of personal data. This may violate GDPR requirements for data protection and could result in significant fines or legal consequences.
• HIPAA: For organizations in the healthcare sector, if the affected systems handle protected health information (PHI), this vulnerability could lead to unauthorized access to PHI. This would violate HIPAA's Security Rule, which requires safeguards to protect the confidentiality, integrity, and availability of PHI.
• Industrial Standards (e.g., IEC 62443, NIST SP 800-82): The vulnerability undermines the security controls required by industrial cybersecurity standards. Failure to address this issue could result in non-compliance with these standards, which are often mandated for critical infrastructure sectors.

Organizations using the affected devices should assess their compliance obligations and take corrective actions, such as applying the provided firmware updates, to mitigate risks and maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade the firmware of affected devices to the corrected versions. For ControlLogix and CompactLogix controllers, upgrade to firmware version V38.011 or later. For the 1756-EN4TR module, upgrade to firmware version V7.001 or later.
• If upgrading is not immediately possible, disable the CRL feature if it is not critical to your operations. This will prevent the vulnerability from being exploited, though it may reduce security controls.
• Ensure that all intermediary certificates used in your environment are valid and not revoked. Remove or replace any revoked certificates to prevent potential exploitation.
• Monitor network traffic for unauthorized or suspicious CIP Security connections. Implement network segmentation to limit access to vulnerable devices.
• Refer to Rockwell Automation's security advisory (SD1788) for additional guidance and updates on the vulnerability.

Useful 0 Not Useful 0