# Rockwell Automation Controllers Vulnerable to Remote Denial-of-Service Attacks Across Critical Manufacturing
## The Threat
Rockwell Automation has disclosed three critical denial-of-service vulnerabilities affecting its widely-deployed CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix programmable logic controllers (PLCs). The vulnerabilities stem from improper input validation and buffer overflow flaws that allow remote attackers to trigger catastrophic failures in industrial control systems managing critical infrastructure worldwide.
The core issue involves a classic buffer overflow weakness in how these controllers process project configuration files. An attacker with network access can craft a malicious project file and upload it to a vulnerable device, causing the PLC to enter a major non-recoverable fault (MNRF) state. Once in this state, the affected controller ceases normal operation and requires manual intervention to restore functionality—potentially halting production lines, manufacturing processes, or other time-sensitive industrial operations.
This vulnerability class is particularly dangerous in industrial settings because PLCs are often designed with fail-safe assumptions: they're supposed to be protected by air-gapping, network segmentation, or at minimum, access controls. Yet the advisory makes clear that unauthenticated remote exploitation is possible, raising the practical threat level considerably for organizations that rely on these controllers in production environments.
## Severity and Impact
| CVE ID | CVSS v3.1 Score | Vector String | Attack Vector | Attack Complexity | Authentication | CWE |
|---|---|---|---|---|---|---|
| CVE-2025-12011 | 8.6 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | Network | Low | None | CWE-680 (Buffer Overflow) |
| CVE-2025-12012 | 8.6 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | Network | Low | None | CWE-680 (Buffer Overflow) |
| CVE-2025-11698 | 8.6 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | Network | Low | None | CWE-680 (Buffer Overflow) |
Impact Classification: High Availability Impact. Successful exploitation results in denial of service, forcing affected controllers into a non-recoverable fault state that disrupts industrial processes.
## Affected Products
CompactLogix Controllers:
ControlLogix Controllers:
GuardLogix Controllers (Safety-Rated Variants):
Recovery Images (All Models):
These controllers are deployed globally across manufacturing facilities, utilities, food and beverage production, chemical processing, and other critical infrastructure sectors.
## Mitigations
Immediate Actions:
1. Prioritize Firmware Updates — Rockwell Automation has released patched firmware versions for all affected models. Update immediately using official distribution channels:
- CompactLogix 5370: Update to V35.016, V36.011 or later
- CompactLogix 5380: Update to V35.012 or later
- CompactLogix 5480: Update to V35.012 or later
- ControlLogix 5570: Update to V35.016, V36.011 or later
- ControlLogix 5580: Update to V35.012 or later
- GuardLogix and Compact GuardLogix models: Follow vendor guidance for version-specific updates
2. Network Segmentation — Restrict network access to PLC management interfaces. Ensure these devices are not directly accessible from untrusted networks or the internet. Use industrial firewalls and VLANs to enforce strict access policies.
3. Access Controls — Implement strong authentication for project uploads and configuration changes. Require credentials and multi-factor authentication where possible for any operations that modify controller settings or firmware.
4. Input Validation — If immediate patching is not feasible, configure network-based controls to block or inspect project files being uploaded to vulnerable devices. Monitor for suspicious project upload attempts.
5. Monitoring and Alerting — Enable detailed logging on PLC management systems to detect attempted project uploads. Alert on any failed uploads or authentication anomalies that could indicate exploitation attempts.
6. Incident Response Planning — Develop procedures for rapid recovery if a controller enters MNRF state, including manual recovery procedures and failover protocols to minimize production downtime.
## References
---
## HackWire Analysis
This disclosure reveals a critical gap in the security posture of industrial control systems at scale. Rockwell Automation's CompactLogix and ControlLogix platforms are among the most widely deployed PLCs globally, meaning this vulnerability affects thousands of operational technology (OT) environments across manufacturing, utilities, and critical infrastructure.
The particularly concerning aspect is the authentication requirement—or rather, the lack thereof. An unauthenticated remote attacker can trigger a major fault, which represents a departure from the security model many organizations assume when deploying PLCs behind firewalls. Many production environments were designed with the assumption that internal networks are trusted, making these controllers vulnerable to insider threats or compromised systems on the same network segment.
The timing also matters. Industrial control systems notoriously operate on long update cycles—many facilities run firmware versions years behind the latest release due to operational stability concerns, regulatory validation requirements, or the sheer difficulty of coordinating downtime in 24/7 production environments. Organizations running Version 34 or 35 firmware that haven't tested the patched releases yet face a difficult choice between the known safety of their current setup and the unknown risks of newer firmware versions.
Defenders should treat this as a high-priority patching initiative, but with appropriate caution: test patches in non-production environments first, validate against any custom control logic, and coordinate updates during planned maintenance windows. For organizations unable to patch immediately, aggressive network segmentation and access controls become essential interim mitigations. This is the type of vulnerability that could motivate investment in OT security infrastructure that organizations have historically deferred.
— HackWire Editorial
## Related Coverage