CVE-2025-12011 Overview
CVE-2025-12011 is a denial-of-service vulnerability affecting Rockwell Automation 5370 and 5570 controllers. A remote unauthenticated attacker can load an invalid project file that forces the device into a major non-recoverable fault (MNRF) state. The controller stops processing until manual intervention restores operation. The flaw is classified under [CWE-120] (Buffer Copy without Checking Size of Input) and is reachable over the network without user interaction.
Critical Impact
A remote attacker without credentials can halt industrial control system operations by triggering a non-recoverable fault, requiring on-site recovery and interrupting production processes.
Affected Products
- Rockwell Automation ControlLogix 5570 controllers
- Rockwell Automation CompactLogix 5370 controllers
- Refer to the Rockwell Automation Security Advisory SD1781 for the full list of affected firmware versions
Discovery Timeline
- 2026-07-14 - CVE-2025-12011 published to NVD
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2025-12011
Vulnerability Analysis
The vulnerability resides in the project-loading logic of the 5370 and 5570 controller firmware. When the controller processes a project file, insufficient bounds checking on input data allows crafted content to overflow an internal buffer. The overflow does not lead to code execution in this case, but it corrupts controller state and triggers a major non-recoverable fault. An MNRF halts controller execution and requires physical intervention or full re-flash to restore normal operation. In operational technology environments, this behavior directly interrupts industrial processes managed by the affected programmable logic controllers (PLCs).
Root Cause
The root cause is improper input validation during project deserialization, classified as [CWE-120]. The firmware copies attacker-controlled fields from the project payload into fixed-size internal structures without validating length. Malformed project data therefore corrupts adjacent memory and forces the runtime into a fault condition it cannot recover from automatically.
Attack Vector
Exploitation requires network access to the controller's engineering or communication interface, typically EtherNet/IP on TCP/UDP 44818 and 2222. No authentication or user interaction is required. An attacker with reachability to the control network sends a crafted project download to the controller, which parses the payload and transitions to MNRF. Segmented control networks reduce reachability, but flat networks and exposed engineering ports allow direct exploitation.
No public proof-of-concept code is available. See the Rockwell Automation Security Advisory for technical details.
Detection Methods for CVE-2025-12011
Indicators of Compromise
- Unexpected transitions of ControlLogix or CompactLogix devices into MNRF state
- Unscheduled project download or firmware update sessions originating from unknown engineering workstations
- EtherNet/IP CIP traffic to TCP 44818 from hosts not on the approved engineering allowlist
- Loss of communication with PLCs immediately following inbound CIP write or download requests
Detection Strategies
- Monitor CIP class 0x64 and 0xA1 messages associated with project download operations against a baseline of legitimate engineering activity
- Alert on controller fault codes reported through FactoryTalk or asset management platforms, correlated with recent network write activity
- Deploy passive OT network sensors that parse EtherNet/IP and flag anomalous project transfer sizes or malformed payloads
Monitoring Recommendations
- Ingest controller diagnostic logs and network telemetry into a centralized SIEM for correlation with IT-side identity and access events
- Track availability metrics per PLC and generate alerts when controllers enter fault states outside maintenance windows
- Baseline expected engineering workstations and firmware versions to rapidly surface unauthorized project pushes
How to Mitigate CVE-2025-12011
Immediate Actions Required
- Apply the firmware updates identified in Rockwell Automation advisory SD1781 to all affected 5370 and 5570 controllers
- Restrict network reachability to controller CIP ports (TCP/UDP 44818, 2222) to authorized engineering workstations only
- Disable or block remote project download capabilities on controllers that do not require them during runtime
- Audit the OT network for exposed PLCs reachable from IT networks or the internet and remove such exposure
Patch Information
Rockwell Automation has published mitigation guidance in Security Advisory SD1781. Administrators should consult the advisory for the specific firmware versions that remediate CVE-2025-12011 for each affected controller family and follow the vendor's upgrade procedures.
Workarounds
- Enforce network segmentation between IT and OT following ISA/IEC 62443 zone and conduit design
- Place affected controllers behind an industrial firewall or data diode that filters CIP traffic and blocks unauthorized project downloads
- Set the controller keyswitch to RUN mode where operationally feasible to prevent remote program mode changes
- Require multi-factor authenticated jump hosts for any engineering session that must reach the OT network
# Example firewall rule to restrict EtherNet/IP access to authorized engineering hosts
iptables -A FORWARD -p tcp --dport 44818 -s 10.10.20.0/24 -d 10.50.0.0/16 -j ACCEPT
iptables -A FORWARD -p tcp --dport 44818 -d 10.50.0.0/16 -j DROP
iptables -A FORWARD -p udp --dport 2222 -d 10.50.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
