A flaw in CompactLogix 5370 controllers permits exploitation due to missing validation of sequence numbers and source IP addresses in the CIP protocol. The exposed Connection IDs on the controller’s web interface can be abused by an adversary to cause a denial‑of‑service condition, resulting in a minor fault. This weakness aligns with CWE‑354, which focuses on improper input validation leading to unintended behavior.

Rockwell Automation CompactLogix 5370 controllers, specifically the 1769 model. Version information indicates that the issue is present before the V38.011 firmware release. Update to V38.011 to remediate the vulnerability.

The CVSS score of 8.7 categorizes this as a high‑severity vulnerability. The EPSS score of less than 1 % indicates a low exploitation probability under current conditions, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw is network‑exposed and exploits a discovered Connection ID, the likely attack vector is remote exploitation via the CIP protocol or web interface. Successful exploitation results in a denial‑of‑service that can affect availability of the controller and any processes relying on it.