The security of our products is important to us as your industrial automation supplier. This security issue was found internally during routine testing and is being reported based on our commitment to customer transparency and improvement of all business environments.
Product Description
The CompactLogix®, ControlLogix®, Compact GuardLogix ® and GuardLogix® families are advanced programmable automation controllers from Rockwell Automation, designed to deliver scalable performance, integrated safety, and secure connectivity for applications ranging from mid-size systems to complex industrial control environments
Affected Products and Solution
Affected Product Family |
CVE |
Affected Firmware Version |
Corrected in Firmware Version |
Affected Catalog Numbers |
CompactLogix® 5370
Compact GuardLogix® 5370
ControlLogix® 5570
GuardLogix® 5570 |
CVE-2025-12011
|
V35.015 and earlier
|
V35.016, V36.011 and later
|
|
CompactLogix® 5380
Compact GuardLogix® 5380
CompactLogix® 5480
ControlLogix® 5580
GuardLogix® 5580 |
CVE-2025-12012 |
V34.012 and earlier V35.011 and earlier |
V34.014, V35.013, V36.011 and later |
|
CompactLogix® 5380 Recovery Image
Compact GuardLogix® 5380 Recovery Image
CompactLogix® 5480 Recovery Image
ControlLogix® 5580 Recovery Image
GuardLogix® 5580 Recovery Image
|
CVE-2025-11698 |
Boot firmware versions before 1.072 |
Boot firmware 1.072 or greater
If using V36.013, V37.011 or later, already has corrected boot firmware is installed |
|
Security Issue Details for CVE-2025-12011
Category |
Details |
CVE ID |
CVE-2025-12011 |
Impact |
A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF). |
CVSS 3.1 Base Score |
|
CVSS 4.0 Base Score |
|
CWE |
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
Known Exploited Vulnerability |
No |
Security Issue Details for CVE-2025-12012
Category |
Details |
CVE ID |
CVE-2025-12012 |
Impact |
A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF). |
CVSS 3.1 Base Score |
|
CVSS 4.0 Base Score |
|
CWE |
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
Known Exploited Vulnerability |
No |
Security Issue Details for CVE-2025-11698
Category |
Details |
CVE ID |
CVE-2025-11698 |
Impact |
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF). |
CVSS 3.1 Base Score |
|
CVSS 4.0 Base Score |
|
CWE |
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
Known Exploited Vulnerability |
No |
CVE-2025-11698 Important Note:
This security issue only affects device Boot Firmware. Boot firmware version can be read from the device via standard Rockwell tools when in out-of-the-box condition. Released firmware versions V36.013/V37.011 and newer will update the boot firmware image to a version with the issue corrected. Installing the latest device firmware will automatically update the boot firmware.
Mitigations and Workarounds
Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use our security best practices and consider disabling the SD card. For more information on how to disable the SD card, see the “Disable the Controller Memory Card” section of the 5380 and 5580 user manual.
Revision History
Revision |
Date |
Description |
1.0 |
7/14/26 |
Initial release |
Glossary:
· SD Card: small, removable memory card used for storing data in devices such as cameras, smartphones, and industrial equipment.
· Denial of Service: Denial of Service (DoS) attack is a malicious attempt to disrupt the normal functioning of a targeted server, service, or network by overwhelming it with a flood of traffic or triggering a crash
· Buffer Overflow: When a program writes more data to a buffer than it can hold, causing the excess data to overflow into adjacent memory locations
· Boot Firmware: The low-level software embedded in a device that executes during power-on, loading the main device firmware. This will be firmware version 1 and updated independently of the device firmware
· Device Firmware: Operational software installed on device that manages control logic, communication protocols, and I/O processing during normal operation
Get Up-to-Date Product Security Information
Visit the Rockwell Automation security advisories on the Trust Center page to:
· Subscribe to product security alerts
· Review the current list of Rockwell Automation security advisories
· Report a possible security issue in a Rockwell Automation product
· Learn more about the vulnerability policy
Support
If you have any questions regarding the security issue(s) above and how to mitigate them, contact TechConnect for help. More information can be found at Contact Us | Rockwell Automation | US.
If you have any questions regarding this disclosure, please contact PSIRT
Email: rasecure@ra.rockwell.com
Legal Disclaimer
ROCKWELL AUTOMATION DOES NOT WARRANT THE COMPLETENESS, TIMELINESS OR ACCURACY OF ANY OF THE DATA CONTAINED IN THIS WEB SITE AND MAY MAKE CHANGES THERETO AT ANY TIME IN ITS SOLE DISCRETION WITHOUT NOTICE. FURTHER, ALL INFORMATION CONVEYED HEREBY IS PROVIDED TO USERS "AS IS." IN NO EVENT SHALL ROCKWELL BE LIABLE FOR ANY DAMAGES OF ANY KIND INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS PROFIT OR DAMAGE, EVEN IF ROCKWELL AUTOMATION HAVE BEEN ADVISED ON THE POSSIBILITY OF SUCH DAMAGES. ROCKWELL AUTOMATION DISCLAIMS ALL WARRANTIES WHETHER EXPRESSED OR IMPLIED IN RESPECT OF THE INFORMATION (INCLUDING SOFTWARE) PROVIDED HEREBY, INCLUDING THE IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR PURPOSE, MERCHANTABILITY, AND NON-INFRINGEMENT. Note that certain jurisdictions do not countenance the exclusion of implied warranties; thus, this disclaimer may not apply to you.
