CWE-119 sitting on top of a length field describes a familiar mechanism: the controller reads a declared length out of a CIP message and operates outside the bounds of the buffer holding it [1][3]. CISA published the advisory as ICSA-26-244-03 [18]. What the published text does not give you is a CVSS vector or a statement of what access the sender needs, so the only precondition you can establish from the document is the ability to put CIP traffic in front of the controller [12].
The recovery language is the part that changes the ticket's owner. A major nonrecoverable fault latches, and the advisory's own remediation text says a power cycle is what clears it [2]. Clearing the fault means someone walking to the panel; no remote action from an engineering workstation restores the controller.
Rockwell's fixed firmware sits exactly one patch release above the top of each affected band: 34.014 goes to 34.015, 35.013 to 35.014, 36.012 to 36.013 [15]. Three live trains got a targeted fix. The V33-and-earlier band got nothing in-train, so the only listed path for those controllers is a move up to V34.015 or later [16]. Sixteen product-and-version rows resolve to a single CVE across all four families, which reads as one shared code path rather than four separate bugs [14][4].
Short of firmware, the offered mitigation is Rockwell's security best practices plus the standard placement guidance CISA attaches to every ICS advisory: keep control systems off the internet, put them behind firewalls, isolate them from business networks, use a VPN when remote access is required [8][11]. None of that is specific to this bug. The work it implies is an inventory keyed on controller firmware revision, because a version band is the only thing here that distinguishes a vulnerable asset from a fixed one [5].
Rockwell found and self-reported the flaw, and the advisory reports no exploitation [13][9]. That ordering matters for planning: the fix exists before any public technique does, and the estates that have to buy an outage window to apply it are the ones with the most to gain from spending that window now rather than under a fault.
