In brief · As of October 2026
A Rockwell plant consists of ControlLogix or CompactLogix controllers in the rack, I/O modules in the chassis and on POINT I/O adapters, Kinetix and PowerFlex drives, PanelView terminals and Stratix switches, all via EtherNet/IP. A ListIdentity broadcast from the maintenance PC returns every device with its own IP including catalog number (in the product name), revision and serial number; modules in the chassis and behind adapters do not answer themselves, only via CIP routing through the controller or the adapter. Rockwell publishes in its advisory portal: 337 advisories, 35 from 2026, each with catalog numbers and firmware versions, without a retrievable CSAF provider. Rockwell does not provide an SBOM per product; for the plant you do not need one.
What hangs on a Logix controller and what of it is visible on the network
The controller is a ControlLogix 5580 or CompactLogix 5380/5480, with modules in the chassis (1756) or on the local bus (5069). Attached via EtherNet/IP are POINT I/O and FLEX adapters with their modules, Kinetix servos, PowerFlex drives, PanelView terminals and Stratix switches. Everything speaks CIP, but not everything has its own IP address.
- Visible via IP from the maintenance PC: every device with its own address answers ListIdentity (UDP 44818): controllers, Ethernet modules (1756-EN2T), adapters, drives, terminals. Stratix switches additionally via SNMP with ENTITY-MIB.
- Only via the controller or the adapter: modules in the ControlLogix chassis, local 5069 modules and the I/O modules behind a POINT I/O adapter. They have an identity (Identity Object) but no IP; they are reachable via CIP routing through backplane port and slot, the way RSLinx shows them in the browse tree.
- Only from the engineering: modules without firmware and the assignment to the sub-plant; both are in the Studio 5000 project.
How rack and adapter modules get into the list: CIP routing and Studio 5000
The Identity Object of every module is reachable via CIP if the request is routed through the controller or the adapter (port 1 = backplane, then slot). A scan that walks the slots after ListIdentity for every chassis found gets catalog number, revision and serial number of all modules, without project and without touching the controller. The Studio 5000 project delivers the same list as the planned state:
- Studio 5000 project (
.ACD, export .L5X): the I/O configuration with catalog number and major revision per module – planned, not measured. - CIP Identity Object via ListIdentity: a UDP broadcast on port 44818 in the subnet, and every EtherNet/IP device answers with vendor ID, device type, product code, revision (major.minor), serial number and product name – at Rockwell the product name usually contains the catalog number ("1756-L83E/B"). That is exactly what RSLinx does during "Browse". Background in the article on the network scan.
- Modules in the rack do not answer individually: ControlLogix chassis and POINT I/O show one identity per IP; the modules behind it can only be reached via CIP routing (port/slot).
- Stratix switches additionally via SNMP (Cisco basis, ENTITY-MIB with serial number and firmware).
How Rockwell publishes advisories and what matching runs on
Rockwell publishes advisories in the Trust Center with a table per advisory: affected product, CVE, affected firmware version, corrected in, affected catalog numbers. Example SD1795 (1 Sep 2026): ControlLogix 5580, GuardLogix 5580, CompactLogix 5380/5480, "Versions prior to 36.013, 35.014, 34.015", catalog 1756-L8z, 1756-L8zS, 5069-L3z, 5069-L3zS, 5069-L4 – the z is a placeholder for the variant.
The portal says: "Security advisories now include Common Security Advisory Framework 2.0 (CSAF) content". We checked: there is no provider-metadata.json under rockwellautomation.com/.well-known/csaf/, no entry in the BSI aggregator, none at CERT@VDE, and the advisory pages SD1700, SD1795 and SD1800 offer only links to CVE records at MITRE under "Downloads". Whether CSAF documents sit behind a login is open. The CSAF detour exists via CISA, which publishes ICS advisories on Rockwell as CSAF.
| Measurement (7 Oct 2026) | Result |
|---|
| Advisories in the portal in total | 337 (2010–2026) |
| Published in 2026 | 35 |
| Published or updated in 2026 | 39 |
| Publications 2023 / 2024 / 2025 | 36 / 55 / 52 |
| Advisories on 1 Sep 2026 alone | 8 (SD1793–SD1800) |
| RSS feed | only the last 51 entries, no archive |
| Retrievable CSAF provider | none found |
Product name from the Identity Object against the catalog number column of the advisory, revision against "prior to 36.013": that is the matching. Two traps: Rockwell writes firmware as "36.013", the Identity Object returns major 36 and minor 13 – the leading zero has to be added. And the placeholder z in "1756-L8z" covers all variants; the device list has to carry the specific variant, the matching the pattern.
Without a CSAF feed, monitoring remains manual work or scraping: RSS covers only 51 entries, the archive is buried in the portal's HTML. Anyone tracking 35 advisories a year with Patch Tuesday bursts of eight in one day by hand loses the 24-hour deadline in the first month.
Rockwell does not provide an SBOM per product; for the plant you do not need one, every advisory names catalog number and firmware.
What this means for installations with Rockwell components
- Run a ListIdentity scan per subnet at acceptance and take over catalog number, revision and serial number per device; add rack modules from the Studio 5000 project.
- Carry firmware as major.minor with a three-digit minor (36.013) so that comparison with the advisory figures works without rework.
- Carry FactoryTalk software (View, Linx, AssetCentre) as a software inventory of the operator and engineering PCs; a large share of the 35 advisories from 2026 concerns software, not controllers.
35 advisories in nine months, eight on a single day, and the modules in the rack only answer when someone addresses the slot. In Werkspilot Scan, Rockwell is stage 2: the run from the maintenance PC covers all EtherNet/IP devices via ListIdentity, walks chassis and adapters via CIP routing and keeps catalog number and revision per module in the notation of the advisories. We are currently trialling this stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.
