A fault in the controller occurs when it receives a crafted CIP message, causing a major nonrecoverable fault that renders the device inoperable until a program download is performed. This vulnerability does not compromise confidentiality or integrity, but it severely disrupts availability, preventing the controller from executing its intended logic. The weakness is identified as CWE‑404, which relates to missing resource handling that leads to failure conditions.

The affected hardware is Rockwell Automation CompactLogix and ControlLogix 5370 and 5570 controllers. All firmware versions prior to 34.016, 35.015, 36.012, and 37.011 are potentially vulnerable, especially on devices with limited memory resources.

The CVSS score of 8.7 classifies this as a high‑severity issue, yet the EPSS score is below 1 %, indicating a very low likelihood of exploitation in the wild. It is not listed in CISA KEV. The likely attack vector is a remote attacker on the industrial network who can inject specially crafted CIP messages to trigger the fault. No special conditions beyond normal network access appear to be required for exploitation.