CVE-2025-9465: ArmorStart LT DoS Vulnerability

CVE-2025-9465 Overview

A denial-of-service vulnerability exists within Rockwell Automation ArmorStart® LT motor controllers. During execution of the Achilles Comprehensive grammar tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds. This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the device fails to properly handle malformed or excessive network input, leading to service disruption.

Critical Impact

This vulnerability allows unauthenticated remote attackers to cause industrial motor controllers to reboot unexpectedly, disrupting critical manufacturing and automation processes with no user interaction required.

Affected Products

• Rockwell Automation ArmorStart® LT Motor Controllers

Discovery Timeline

• 2026-01-20 - CVE CVE-2025-9465 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-9465

Vulnerability Analysis

This vulnerability stems from improper handling of network traffic by the ArmorStart® LT device. When the device processes certain crafted network packets, particularly those conforming to Achilles Comprehensive grammar test patterns, it fails to manage resources effectively. The result is an unexpected device reboot that takes the Link State Monitor offline for several seconds.

The attack can be executed remotely over the network without requiring authentication or user interaction. The vulnerability specifically affects device availability without impacting confidentiality or integrity of data. In industrial control system (ICS) environments, even brief disruptions to motor controllers can have cascading effects on production lines and safety systems.

Root Cause

The root cause is CWE-400: Uncontrolled Resource Consumption. The ArmorStart® LT firmware does not properly validate or rate-limit incoming network packets, allowing an attacker to send specially crafted traffic that exhausts device resources. When the device encounters these malformed grammar test packets, it triggers an unhandled exception or resource exhaustion condition that forces a protective reboot.

Attack Vector

The attack vector is network-based, requiring no authentication or privileges. An attacker with network access to the ArmorStart® LT device can send malformed packets that trigger the denial-of-service condition. The attack does not require any user interaction and can be executed remotely.

The exploitation scenario involves sending Achilles Comprehensive grammar test patterns to the target device. These patterns are designed to test protocol robustness and can expose weaknesses in input validation. When the ArmorStart® LT receives these packets, it fails to process them safely, resulting in a device reboot and temporary loss of the Link State Monitor functionality.

Detection Methods for CVE-2025-9465

Indicators of Compromise

• Unexpected or frequent reboots of ArmorStart® LT motor controllers
• Link State Monitor going offline for brief periods (several seconds)
• Unusual network traffic patterns targeting industrial control devices
• Log entries indicating abnormal packet processing or resource exhaustion

Detection Strategies

• Monitor network traffic to ArmorStart® LT devices for abnormal packet volumes or malformed protocol data
• Implement ICS-specific intrusion detection systems (IDS) capable of identifying Achilles-style fuzzing patterns
• Configure alerting for unexpected device reboots in SCADA/HMI systems
• Deploy network segmentation monitoring to detect unauthorized access to OT network zones

Monitoring Recommendations

• Enable syslog or event logging on ArmorStart® LT devices if supported and monitor for reboot events
• Implement network traffic analysis on OT network segments containing affected devices
• Configure SNMP traps or industrial protocol monitoring for device availability status changes
• Establish baseline network behavior for motor controllers to identify anomalous traffic patterns

How to Mitigate CVE-2025-9465

Immediate Actions Required

• Review the Rockwell Automation Security Advisory for specific remediation guidance
• Implement network segmentation to isolate ArmorStart® LT devices from untrusted networks
• Apply firewall rules to restrict network access to affected devices to authorized systems only
• Monitor affected devices for signs of exploitation or unexpected reboots

Patch Information

Rockwell Automation has published a security advisory addressing this vulnerability. Organizations should consult the Rockwell Automation Security Advisory SD1768 for specific firmware updates and remediation instructions. Contact Rockwell Automation support for guidance on obtaining and applying the appropriate patches for your ArmorStart® LT devices.

Workarounds

• Implement strict network segmentation between IT and OT networks to limit exposure of ArmorStart® LT devices
• Deploy industrial firewalls or security appliances to filter malformed traffic before it reaches affected devices
• Disable unnecessary network services on the ArmorStart® LT if configuration options permit
• Consider implementing redundant motor control systems where brief outages would have critical impact

# Example firewall rule to restrict access to ArmorStart LT devices
# Replace <ARMORSTART_IP> with actual device IP and <TRUSTED_SUBNET> with authorized network
iptables -A INPUT -d <ARMORSTART_IP> -s <TRUSTED_SUBNET> -j ACCEPT
iptables -A INPUT -d <ARMORSTART_IP> -j DROP