Summary
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controllers are communicating with Rockwell Automation design software. If successfully exploited, this vulnerability could allow an unauthorized application to connect with Logix controllers. To leverage this vulnerability, an unauthorized user would require network access to the controller.
- Vendor
- Rockwell
- Product
- Multiple Products
- Added to KEV
- Mar 5, 2026
- Remediation due
- Mar 26, 2026 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-522
- EPSS
- 63.6% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References