CVE-2025-12012: Controller DoS Vulnerability via Invalid Data

CVE-2025-12012 Overview

CVE-2025-12012 is a denial-of-service vulnerability affecting Rockwell Automation 5380, 5480, and 5580 controllers. An unauthenticated attacker with network access can write invalid file data to the controller. The controller then enters a major non-recoverable fault (MNRF) state, halting operations until manual intervention restores service.

The flaw is classified as a buffer copy without checking size of input [CWE-120]. It carries a CVSS 4.0 score of 9.2 due to network reachability and high impact on availability of both the vulnerable component and downstream subsequent systems.

Critical Impact
Successful exploitation forces industrial controllers into a non-recoverable fault state, disrupting operational technology (OT) processes and requiring manual recovery.

Affected Products

Rockwell Automation ControlLogix 5580 controllers
Rockwell Automation CompactLogix 5380 controllers
Rockwell Automation Compact GuardLogix 5480 controllers

Discovery Timeline

2026-07-14 - CVE-2025-12012 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2025-12012

Vulnerability Analysis

The vulnerability exists in the file-handling logic of the affected Logix controllers. When the controller receives malformed or oversized file data over the network, input validation fails to constrain the write operation. The malformed data corrupts internal state and triggers a major non-recoverable fault.

An MNRF requires physical or administrative intervention to clear. The controller stops executing user logic, disrupts process I/O, and cannot resume automatically. In industrial environments, this translates directly to process shutdown or unsafe states in dependent equipment.

The attack requires no authentication and no user interaction. Any attacker with routable network access to the controller's programming or file transfer service can trigger the fault.

Root Cause

The root cause is a buffer-handling defect classified under [CWE-120], buffer copy without checking size of input. The controller firmware copies file data into an internal buffer without validating length or content constraints. Invalid data reaches the fault handler, which escalates to MNRF rather than rejecting the input gracefully.

Attack Vector

Exploitation occurs over the network against exposed controller services. An attacker crafts a file write request containing invalid data and sends it to the controller. No credentials are required. The controller processes the request, corrupts its internal state, and transitions to a non-recoverable fault. Refer to the Rockwell Automation Security Advisory for protocol-level details.

Detection Methods for CVE-2025-12012

Indicators of Compromise

Unexpected transitions of 5380, 5480, or 5580 controllers into major non-recoverable fault (MNRF) state without a preceding maintenance event.
File write or download requests to controller CIP services originating from unauthorized engineering workstations or external IP ranges.
Loss of communication with programmable logic controllers (PLCs) followed by required manual reset to restore operation.

Detection Strategies

Monitor Common Industrial Protocol (CIP) traffic for malformed file service requests targeting Logix controllers.
Correlate controller fault events from asset management platforms such as FactoryTalk AssetCentre with network traffic captures.
Alert on any CIP file-write session initiated from a source outside a defined allowlist of engineering hosts.

Monitoring Recommendations

Deploy OT-aware intrusion detection sensors on cell and area zone networks to inspect Ethernet/IP traffic.
Track controller mode and fault status via SNMP or vendor telemetry and forward events to the security information and event management (SIEM) platform.
Baseline normal file transfer activity to controllers and alert on deviations in volume, source, or timing.

How to Mitigate CVE-2025-12012

Immediate Actions Required

Inventory all 5380, 5480, and 5580 controllers and identify firmware versions in production environments.
Apply the firmware updates published in the Rockwell Automation Security Advisory SD1781.
Restrict network reachability to controllers using firewall rules and OT network segmentation aligned with IEC 62443 zone and conduit models.

Patch Information

Rockwell Automation has published remediation guidance in security advisory SD1781. Consult the advisory for the specific fixed firmware revisions applicable to each affected controller family and follow vendor-approved upgrade procedures during scheduled maintenance windows.

Workarounds

Place controllers behind an industrial demilitarized zone (IDMZ) and block CIP file services from untrusted networks.
Enforce controller key-switch settings in RUN mode to reject remote programming and file download operations.
Restrict access to CIP ports (TCP/44818 and UDP/2222) to authorized engineering workstations only.
Enable Rockwell FactoryTalk Policy Manager and CIP Security where supported to authenticate and integrity-check controller communications.

bash

# Example firewall rule to restrict CIP access to authorized engineering hosts
iptables -A FORWARD -p tcp --dport 44818 -s 10.10.20.0/24 -d 10.20.30.0/24 -j ACCEPT
iptables -A FORWARD -p tcp --dport 44818 -d 10.20.30.0/24 -j DROP
iptables -A FORWARD -p udp --dport 2222  -d 10.20.30.0/24 -j DROP