Rockwell Automation PLC Firmware Vulnerability CVE-2021-42260 - Denial of Service Risk

Rockwell Automation has identified a vulnerability in several lines of its programmable automation controllers, including ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, and Compact GuardLogix. The issue stems from a loop with an unreachable exit condition, commonly known as an infinite loop, within the firmware logic. An attacker with the ability to send corrupt crafted data to the affected controllers could trigger this condition, leading to a denial of service.

The vulnerability, tracked as CVE-2021-42260, carries a CVSS v3 base score of 7.5, classified as HIGH. The primary impact is on availability, with the potential to cause a major nonrecoverable fault (MNRF). For safety-rated controllers, such as GuardLogix and Compact GuardLogix, recovery requires a program download. Non-safety controllers require a stage 2 reset to restore normal operation.

Affected firmware versions vary by product line. Rockwell Automation recommends the following minimum updates: ControlLogix 5580 and GuardLogix 5580 versions 34.015 and later; CompactLogix 5380, Compact GuardLogix 5380, and CompactLogix 5480 versions 37.011 and later. Earlier versions are considered known_affected.

The vulnerability was originally assigned on 2021-11-04 and was reported to CISA by Rockwell Automation. The advisory was re-published by CISA on 2026-09-01 as ICSA-26-244-05. While the vulnerability allows for denial-of-service conditions via crafted data, there are no confirmed reports of active exploitation in the wild at the time of reporting. CISA and Rockwell Automation recommend minimizing network exposure, isolating control system networks behind firewalls, and using VPNs for any required remote access.