Rockwell Automation ControlLogix, GuardLogix, and CompactLogix

A denial-of-service vulnerability in Rockwell Automation ControlLogix, GuardLogix, and CompactLogix controllers running firmware V34.011 and earlier allows an unauthenticated attacker on the local network to send a specially crafted packet via mDNS (multicast DNS, port 5353) that causes the device to become unresponsive. The vulnerability affects all ControlLogix 5580, GuardLogix 5580, CompactLogix 5380, Compact GuardLogix 5380, and CompactLogix 5480 series controllers at the vulnerable version level, as well as the 1756-EN4 Ethernet module at V4.001. Successful exploitation results in loss of availability—the device stops responding to legitimate commands and operations until manually restarted. No public exploitation has been reported, but the vulnerability is remotely triggerable on any local-network-attached device.