PT-2026-49718 · Rockwell Automation · Compactlogix 5370

Published 2026-06-16 · Updated 2026-06-16 · CVE-2026-9307

Mitre

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs on the diagnostics webpage, which are accessible to any unauthenticated user on the network. This information can be leveraged by an attacker to construct malicious packets, leading to Denial-of-Service.

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2026-9307

Affected Products

Compactlogix 5370

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-9307 · Security Note
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1776.html · Note