Critical OT Flaws Expose Rockwell and WAGO Devices to Remote Compromise

Rockwell Automation, Siemens, and Schneider Electric issued July industrial security advisories covering dozens of OT vulnerabilities, with Rockwell disclosing multiple high-impact flaws in control and I/O products. The most severe Rockwell issue, CVE-2026-10577, affects 1715 Redundant IO and exposes a network-accessible debug port without authentication, allowing remote attackers to run intrusive CLI commands, read or delete files, stop tasks, modify memory, and change I/O states; the flaw carries a CVSS v4.0 score of 10.0. Rockwell also reported CVE-2026-9636, a CIP Security certificate revocation handling weakness in several CompactLogix 5380, ControlLogix 5580, GuardLogix 5580, and 1756-EN4 devices that could let a network attacker connect with a certificate that should no longer be trusted, and CVE-2025-11698, a buffer overflow in Logix controller recovery images that can trigger a major non-recoverable fault and cause denial of service.

Separately, CERT VDE published VDE-2026-031 for CVE-2026-4769, a critical WAGO System I/O Field vulnerability caused by an undocumented internal diagnostic function exposed without authentication during early boot. An unauthenticated remote attacker can exploit the startup window to access internal system processes and fully compromise affected 0765-series devices; the issue is rated CVSS 3.1 9.8 and CVSS 4.0 9.3. Siemens also disclosed CVE-2025-40945, an untrusted search path flaw in the IAM Client SDK used across products including COMOS, Designcenter NX, Simcenter, Solid Edge, Teamcenter Visualization, and Tecnomatix, enabling local privilege escalation for authenticated users and reinforcing the breadth of current patching demands across industrial environments.