VulnerabilityAwaiting Analysis

CVE-2026-9307

A sensitive information disclosure security issue exists within the affected CompactLogix controllers.

MEDIUM 6.3EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

A sensitive information disclosure security issue exists within the affected CompactLogix controllers. The controller's web server exposes CIP Connection IDs on the diagnostics webpage, which are accessible to any unauthenticated user on the network. This information can be leveraged by an attacker to construct malicious packets, leading to Denial-of-Service.

CVSS 4.0: 6.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.30% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-497
Source: PSIRT@rockwellautomation.com

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1776.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.