Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and 1756-EN4TR Improper Check for Certificate Revocation (CVE-2026-9636)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505889);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/29");

  script_cve_id("CVE-2026-9636");

  script_name(english:"Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and 1756-EN4TR Improper Check for Certificate Revocation (CVE-2026-9636)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"The affected products fail to properly reject certificates signed by
an intermediate certificate authority that has been revoked via a
Certificate Revocation List (CRL). A network-based attacker who holds
such a certificate can leverage it to establish a Common Industrial
Protocol (CIP) Security session that should be untrusted, potentially
bypassing CIP Security protections. This issue only affects users who
have the CRL feature enabled and are using intermediate certificates.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1788.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?fa70d2b6");
  script_set_attribute(attribute:"solution", value:
"Rockwell Automation recommends users update to the following corrected versions:

- ControlLogix 5580: Update to V38.011 or later.
- CompactLogix 5380: Update to V38.011 or later.
- GuardLogix 5580: Update to V38.011 or later.
- Compact GuardLogix 5380: Update to V38.011 or later.
- 1756-EN4TR: Update to V7.001 or later.

Rockwell Automation also recommends users follow their published Security Best Practices.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-9636");

  script_cwe_id(299);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/29");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:controllogix_5580_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:compactlogix_5380_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:guardlogix_5580_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:compact_guardlogix_5380_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:rockwellautomation:1756-en4tr_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Rockwell");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Rockwell');

var asset = tenable_ot::assets::get(vendor:'Rockwell');

var vuln_cpes = {
    "cpe:/o:rockwellautomation:controllogix_5580_firmware:36" :
        {"versionEndExcluding" : "38.011", "versionStartIncluding" : "36", "family" : "ControlLogix5580"},
    "cpe:/o:rockwellautomation:compactlogix_5380_firmware:36" :
        {"versionEndExcluding" : "38.011", "versionStartIncluding" : "36", "family" : "CompactLogix5380"},
    "cpe:/o:rockwellautomation:guardlogix_5580_firmware:36" :
        {"versionEndExcluding" : "38.011", "versionStartIncluding" : "36", "family" : "GuardLogix5580"},
    "cpe:/o:rockwellautomation:compact_guardlogix_5380_firmware:36" :
        {"versionEndExcluding" : "38.011", "versionStartIncluding" : "36", "family" : "GuardLogix5380"},
    "cpe:/o:rockwellautomation:1756-en4tr_firmware:6" :
        {"versionEndExcluding" : "7.001", "versionStartIncluding" : "6.001", "family" : "ControlLogix"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);