Rockwell Automation ICS Products Hit by Authentication, Authorization, DoS, and RCE Flaws

CISA republished multiple Rockwell Automation advisories covering vulnerabilities across FactoryTalk Analytics PavilionX, RSLinx Classic, CompactLogix 5370, Logix 5370/5570 controllers, and FLEX I/O EtherNet/IP Adapters used in critical manufacturing environments worldwide. The issues include an authorization bypass in PavilionX (CVE-2025-14272) that could let an unauthenticated attacker perform privileged administrative actions, and a third-party flaw in RSLinx Classic (CVE-2020-13573) tied to out-of-bounds read and stack-based buffer overflow conditions that could cause denial of service or enable remote arbitrary code execution.

Additional advisories detail multiple CIP-related denial-of-service weaknesses in CompactLogix and Logix controllers, including CVE-2026-11317, where crafted CIP messages can trigger major nonrecoverable faults requiring a program download, as well as sequence-number, source-IP, and connection-ID issues that can induce controller faults. CISA also warned that FLEX I/O EtherNet/IP Adapters version 2.012 are affected by CVE-2026-0646, which can fault devices through malformed CIP requests, and CVE-2026-0647, a critical authentication bypass in the embedded web server that allows password changes through a crafted HTTP GET request, potentially leading to account takeover and loss of availability; CISA said no known public exploitation had been reported and urged operators to isolate control networks, reduce internet exposure, and secure remote access with firewalls and updated VPNs.