CVE-2025-11694: 1769 CompactLogix Controller DoS Flaw

CVE-2025-11694 Overview

CVE-2025-11694 affects Rockwell Automation 1769 CompactLogix controllers. The vulnerability stems from missing validation of sequence numbers and source IP addresses within the Common Industrial Protocol (CIP). Attackers can abuse exposed Connection IDs visible on the controller's web interface to send forged CIP packets. This triggers a minor fault condition on the affected controller, disrupting industrial control system availability. The flaw is classified under [CWE-354] Improper Validation of Integrity Check Value and carries a CVSS 4.0 score of 8.7.

Critical Impact
Unauthenticated remote attackers can induce denial-of-service conditions on 1769 CompactLogix controllers by exploiting predictable CIP Connection IDs, causing minor faults that disrupt operational technology environments.

Affected Products

Rockwell Automation 1769 CompactLogix Controllers
CIP protocol implementations on affected firmware versions
Industrial control systems exposing the controller web interface

Discovery Timeline

2026-06-16 - CVE-2025-11694 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11694

Vulnerability Analysis

The vulnerability resides in how 1769 CompactLogix controllers process CIP messages over the network. The controller does not validate the sequence numbers attached to incoming CIP packets. It also fails to verify whether source IP addresses match the legitimate originator of an established CIP connection. An attacker on the same network can craft and inject CIP packets that the controller accepts as valid. The result is a minor fault on the controller, interrupting normal program execution and impacting availability of the industrial process.

Root Cause

The root cause is improper integrity validation within the CIP protocol stack on the controller. Two checks are missing: sequence number verification and source IP address validation. Without these controls, the controller treats forged packets as authentic communication from an established peer.

Attack Vector

The attack is performed over the network without authentication or user interaction. The controller's web interface exposes active CIP Connection IDs. An attacker reads these identifiers and constructs CIP packets referencing the exposed Connection IDs. Once injected, the malicious packets bypass the controller's weak session validation and trigger fault conditions. The vulnerability impacts availability only — confidentiality and integrity of process data are not directly affected.

No public proof-of-concept exploit is available. Refer to the Rockwell Automation Security Advisory SD1776 for vendor technical details.

Detection Methods for CVE-2025-11694

Indicators of Compromise

Unexpected minor fault conditions logged on 1769 CompactLogix controllers without operational cause
CIP packets containing valid Connection IDs originating from unexpected source IP addresses
Anomalous sequence number patterns within established CIP sessions
Unauthenticated HTTP requests to the controller web interface enumerating Connection IDs

Detection Strategies

Deploy industrial network monitoring tools capable of parsing CIP traffic and validating session continuity
Alert on CIP traffic where the source IP does not match the registered peer of an active Connection ID
Correlate controller fault events with network packet captures to identify forged CIP packets
Monitor web interface access logs for enumeration of Connection ID values

Monitoring Recommendations

Baseline expected CIP communication peers for each controller and alert on deviations
Forward controller diagnostic logs and OT network telemetry to a central SIEM for correlation
Track minor fault frequency over time to detect abnormal spikes indicative of active exploitation

How to Mitigate CVE-2025-11694

Immediate Actions Required

Restrict network access to the 1769 CompactLogix controller web interface using firewall rules and ACLs
Place affected controllers behind a properly segmented OT network zone with strict ingress filtering
Disable the web interface on controllers where it is not operationally required
Apply vendor firmware updates as soon as they are released by Rockwell Automation

Patch Information

Refer to the Rockwell Automation Security Advisory SD1776 for current patch availability, affected firmware versions, and remediation guidance from the vendor.

Workarounds

Implement network segmentation following ISA/IEC 62443 zone and conduit principles to isolate controllers from untrusted networks
Use a CIP-aware firewall or industrial IDS to block unauthorized sources from communicating with controllers
Limit access to the controller web interface to a small set of trusted engineering workstations via IP allowlists
Disable or restrict the HTTP service exposing Connection IDs where firmware configuration permits

bash

# Example firewall configuration restricting CIP (TCP/UDP 44818, TCP 2222) access
# Allow only engineering workstation subnet to reach the controller
iptables -A FORWARD -s 10.10.20.0/24 -d 10.20.30.40 -p tcp --dport 44818 -j ACCEPT
iptables -A FORWARD -s 10.10.20.0/24 -d 10.20.30.40 -p tcp --dport 2222 -j ACCEPT
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 44818 -j DROP
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 2222 -j DROP
# Block external access to the controller web interface
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 80 -j DROP