Vulnerability-Lookup

WID-SEC-W-2026-2338

Vulnerability from csaf_certbund - Published: 2026-07-14 22:00 - Updated: 2026-07-16 22:00

Summary

Rockwell Automation CompactLogix und ControlLogix: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Rockwell Automation CompactLogix ist eine Familie von speicherprogrammierbaren Steuerungen (SPS) für Automatisierungsanwendungen. ControlLogix bezeichnet eine Produktfamilie von Steuerungssystemen für Industrieanlagen.

Angriff: Ein Angreifer kann mehrere Schwachstellen in Rockwell Automation CompactLogix und Rockwell Automation ControlLogix ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.

Betroffene Betriebssysteme: - Sonstiges

CVE-2025-11698

Affected products

Known affected 8 products

Product	Identifier	Version
Rockwell Automation CompactLogix 5480 Recovery Image <Boot firmware 1.072 Rockwell Automation / CompactLogix		5480 Recovery Image <Boot firmware 1.072
Rockwell Automation ControlLogix 5580 Recovery Image <Boot firmware 1.072 Rockwell Automation / ControlLogix		5580 Recovery Image <Boot firmware 1.072
Rockwell Automation CompactLogix 5370 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5370`	5370
Rockwell Automation ControlLogix 5570 Rockwell Automation / ControlLogix	`cpe:/o:rockwellautomation:controllogix:5570`	5570
Rockwell Automation CompactLogix 5380 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5380`	5380
Rockwell Automation CompactLogix 5480 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5480`	5480
Rockwell Automation ControlLogix 5580 Rockwell Automation / ControlLogix	`cpe:/o:rockwellautomation:controllogix:5580`	5580
Rockwell Automation CompactLogix 5380 Recovery Image <Boot firmware 1.072 Rockwell Automation / CompactLogix		5380 Recovery Image <Boot firmware 1.072

CVE-2025-12011

Affected products

Known affected 8 products

Product	Identifier	Version
Rockwell Automation CompactLogix 5480 Recovery Image <Boot firmware 1.072 Rockwell Automation / CompactLogix		5480 Recovery Image <Boot firmware 1.072
Rockwell Automation ControlLogix 5580 Recovery Image <Boot firmware 1.072 Rockwell Automation / ControlLogix		5580 Recovery Image <Boot firmware 1.072
Rockwell Automation CompactLogix 5370 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5370`	5370
Rockwell Automation ControlLogix 5570 Rockwell Automation / ControlLogix	`cpe:/o:rockwellautomation:controllogix:5570`	5570
Rockwell Automation CompactLogix 5380 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5380`	5380
Rockwell Automation CompactLogix 5480 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5480`	5480
Rockwell Automation ControlLogix 5580 Rockwell Automation / ControlLogix	`cpe:/o:rockwellautomation:controllogix:5580`	5580
Rockwell Automation CompactLogix 5380 Recovery Image <Boot firmware 1.072 Rockwell Automation / CompactLogix		5380 Recovery Image <Boot firmware 1.072

CVE-2025-12012

Affected products

Known affected 8 products

Product	Identifier	Version
Rockwell Automation CompactLogix 5480 Recovery Image <Boot firmware 1.072 Rockwell Automation / CompactLogix		5480 Recovery Image <Boot firmware 1.072
Rockwell Automation ControlLogix 5580 Recovery Image <Boot firmware 1.072 Rockwell Automation / ControlLogix		5580 Recovery Image <Boot firmware 1.072
Rockwell Automation CompactLogix 5370 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5370`	5370
Rockwell Automation ControlLogix 5570 Rockwell Automation / ControlLogix	`cpe:/o:rockwellautomation:controllogix:5570`	5570
Rockwell Automation CompactLogix 5380 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5380`	5380
Rockwell Automation CompactLogix 5480 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5480`	5480
Rockwell Automation ControlLogix 5580 Rockwell Automation / ControlLogix	`cpe:/o:rockwellautomation:controllogix:5580`	5580
Rockwell Automation CompactLogix 5380 Recovery Image <Boot firmware 1.072 Rockwell Automation / CompactLogix		5380 Recovery Image <Boot firmware 1.072

CVE-2026-9636

Affected products

Known affected 2 products

Product	Identifier	Version	Remediation
Rockwell Automation CompactLogix 5380 Rockwell Automation / CompactLogix	`cpe:/o:rockwellautomation:compactlogix:5380`	5380
Rockwell Automation ControlLogix 5580 Rockwell Automation / ControlLogix	`cpe:/o:rockwellautomation:controllogix:5580`	5580

References

6 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://www.rockwellautomation.com/en-us/trust-ce…	external
https://www.rockwellautomation.com/en-us/trust-ce…	external
https://euvd.enisa.europa.eu/enisa/EUVD-2025-210463	external
https://euvd.enisa.europa.eu/enisa/EUVD-2026-43709	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Rockwell Automation CompactLogix ist eine Familie von speicherprogrammierbaren Steuerungen (SPS) f\u00fcr Automatisierungsanwendungen.\r\nControlLogix bezeichnet eine Produktfamilie von Steuerungssystemen f\u00fcr Industrieanlagen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Rockwell Automation CompactLogix und Rockwell Automation ControlLogix ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren oder vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-2338 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2338.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-2338 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2338"
      },
      {
        "category": "external",
        "summary": "Rockwell Automation Security Advisory SD1781 vom 2026-07-14",
        "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html"
      },
      {
        "category": "external",
        "summary": "Rockwell Automation Security Advisory SD1781 vom 2026-07-14",
        "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1788.html"
      },
      {
        "category": "external",
        "summary": "EUVD Security Advisory vom 2026-07-14",
        "url": "https://euvd.enisa.europa.eu/enisa/EUVD-2025-210463"
      },
      {
        "category": "external",
        "summary": "EUVD Security Advisory vom 2026-07-14",
        "url": "https://euvd.enisa.europa.eu/enisa/EUVD-2026-43709"
      }
    ],
    "source_lang": "en-US",
    "title": "Rockwell Automation CompactLogix und ControlLogix: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-07-16T22:00:00.000+00:00",
      "generator": {
        "date": "2026-07-17T05:40:05.814+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-2338",
      "initial_release_date": "2026-07-14T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-07-14T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-07-16T22:00:00.000+00:00",
          "number": "2",
          "summary": "Rockwell Referenz korrigiert"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "5380 Recovery Image \u003cBoot firmware 1.072",
                "product": {
                  "name": "Rockwell Automation CompactLogix 5380 Recovery Image \u003cBoot firmware 1.072",
                  "product_id": "T056543"
                }
              },
              {
                "category": "product_version",
                "name": "5380 Recovery Image Boot firmware 1.072",
                "product": {
                  "name": "Rockwell Automation CompactLogix 5380 Recovery Image Boot firmware 1.072",
                  "product_id": "T056543-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:rockwellautomation:compactlogix:5380_recovery_image__boot_firmware_1.072"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "5480 Recovery Image \u003cBoot firmware 1.072",
                "product": {
                  "name": "Rockwell Automation CompactLogix 5480 Recovery Image \u003cBoot firmware 1.072",
                  "product_id": "T056544"
                }
              },
              {
                "category": "product_version",
                "name": "5480 Recovery Image Boot firmware 1.072",
                "product": {
                  "name": "Rockwell Automation CompactLogix 5480 Recovery Image Boot firmware 1.072",
                  "product_id": "T056544-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:rockwellautomation:compactlogix:5480_recovery_image__boot_firmware_1.072"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5370",
                "product": {
                  "name": "Rockwell Automation CompactLogix 5370",
                  "product_id": "T056546",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:rockwellautomation:compactlogix:5370"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5380",
                "product": {
                  "name": "Rockwell Automation CompactLogix 5380",
                  "product_id": "T056548",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:rockwellautomation:compactlogix:5380"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5480",
                "product": {
                  "name": "Rockwell Automation CompactLogix 5480",
                  "product_id": "T056549",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:rockwellautomation:compactlogix:5480"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "CompactLogix"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "5580 Recovery Image \u003cBoot firmware 1.072",
                "product": {
                  "name": "Rockwell Automation ControlLogix 5580 Recovery Image \u003cBoot firmware 1.072",
                  "product_id": "T056545"
                }
              },
              {
                "category": "product_version",
                "name": "5580 Recovery Image Boot firmware 1.072",
                "product": {
                  "name": "Rockwell Automation ControlLogix 5580 Recovery Image Boot firmware 1.072",
                  "product_id": "T056545-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:rockwellautomation:controllogix:5580_recovery_image__boot_firmware_1.072"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5570",
                "product": {
                  "name": "Rockwell Automation ControlLogix 5570",
                  "product_id": "T056547",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:rockwellautomation:controllogix:5570"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5580",
                "product": {
                  "name": "Rockwell Automation ControlLogix 5580",
                  "product_id": "T056550",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:rockwellautomation:controllogix:5580"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "ControlLogix"
          }
        ],
        "category": "vendor",
        "name": "Rockwell Automation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-11698",
      "product_status": {
        "known_affected": [
          "T056544",
          "T056545",
          "T056546",
          "T056547",
          "T056548",
          "T056549",
          "T056550",
          "T056543"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2025-11698"
    },
    {
      "cve": "CVE-2025-12011",
      "product_status": {
        "known_affected": [
          "T056544",
          "T056545",
          "T056546",
          "T056547",
          "T056548",
          "T056549",
          "T056550",
          "T056543"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2025-12011"
    },
    {
      "cve": "CVE-2025-12012",
      "product_status": {
        "known_affected": [
          "T056544",
          "T056545",
          "T056546",
          "T056547",
          "T056548",
          "T056549",
          "T056550",
          "T056543"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2025-12012"
    },
    {
      "cve": "CVE-2026-9636",
      "product_status": {
        "known_affected": [
          "T056548",
          "T056550"
        ]
      },
      "release_date": "2026-07-14T22:00:00.000+00:00",
      "title": "CVE-2026-9636"
    }
  ]
}

CVE-2025-11698 (GCVE-0-2025-11698)

Vulnerability from cvelistv5 – Published: 2026-07-14 15:05 – Updated: 2026-07-14 15:53

Title

CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow

Summary

A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

Rockwell

References

1 reference

URL	Tags
https://www.rockwellautomation.com/en-us/trust-ce…

Impacted products

1 product

Vendor	Product	Version
Rockwell Automation	CompactLogix® 5380 Recovery Image Compact GuardLogix® 5380 Recovery Image CompactLogix® 5480 Recovery Image ControlLogix® 5580 Recovery Image GuardLogix® 5580 Recovery Image	Affected: Boot firmware versions before 1.072

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11698",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T15:53:12.986743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T15:53:19.355Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CompactLogix\u00ae 5380 Recovery Image      Compact GuardLogix\u00ae 5380 Recovery Image      CompactLogix\u00ae 5480 Recovery Image      ControlLogix\u00ae 5580 Recovery Image      GuardLogix\u00ae 5580 Recovery Image",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "Boot firmware versions before 1.072"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A denial-of-service issue exists in\u0026nbsp;5380/5480/5580\u0026nbsp;controllers\u0026nbsp;boot\u0026nbsp;firmware\u0026nbsp;lower than version 1.072.\u0026nbsp;This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to\u0026nbsp;enter a major non-recoverable fault (MNRF).\u0026nbsp;"
            }
          ],
          "value": "A denial-of-service issue exists in\u00a05380/5480/5580\u00a0controllers\u00a0boot\u00a0firmware\u00a0lower than version 1.072.\u00a0This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to\u00a0enter a major non-recoverable fault (MNRF)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:05:32.682Z",
        "orgId": "b73dd486-f505-4403-b634-40b078b177f0",
        "shortName": "Rockwell"
      },
      "references": [
        {
          "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html"
        }
      ],
      "source": {
        "advisory": "SD1781",
        "discovery": "INTERNAL"
      },
      "title": "CompactLogix \u00ae, ControlLogix \u00ae, Compact GuardLogix \u00ae and GuardLogix \u00ae Buffer Overflow",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
    "assignerShortName": "Rockwell",
    "cveId": "CVE-2025-11698",
    "datePublished": "2026-07-14T15:05:32.682Z",
    "dateReserved": "2025-10-13T16:23:13.209Z",
    "dateUpdated": "2026-07-14T15:53:19.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12011 (GCVE-0-2025-12011)

Vulnerability from cvelistv5 – Published: 2026-07-14 15:03 – Updated: 2026-07-14 15:26

Title

CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow

Summary

A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

Rockwell

References

1 reference

URL	Tags
https://www.rockwellautomation.com/en-us/trust-ce…

Impacted products

1 product

Vendor	Product	Version
Rockwell Automation	CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570	Affected: 35.015 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12011",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T15:26:14.053988Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T15:26:29.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CompactLogix\u00ae 5370      Compact GuardLogix\u00ae 5370      ControlLogix\u00ae 5570      GuardLogix\u00ae 5570",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "35.015 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A denial-of-service issue exists\u0026nbsp;in\u0026nbsp;\u0026nbsp;5370/5570\u0026nbsp;controllers. This vulnerability could potentially allow a\u0026nbsp;remote\u0026nbsp;user to\u0026nbsp;load an invalid project, causing the device to\u0026nbsp;enter\u0026nbsp;a\u0026nbsp;major non-recoverable fault (MNRF).\u0026nbsp;"
            }
          ],
          "value": "A denial-of-service issue exists\u00a0in\u00a0\u00a05370/5570\u00a0controllers. This vulnerability could potentially allow a\u00a0remote\u00a0user to\u00a0load an invalid project, causing the device to\u00a0enter\u00a0a\u00a0major non-recoverable fault (MNRF)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:03:11.708Z",
        "orgId": "b73dd486-f505-4403-b634-40b078b177f0",
        "shortName": "Rockwell"
      },
      "references": [
        {
          "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html"
        }
      ],
      "source": {
        "advisory": "SD1781",
        "discovery": "UNKNOWN"
      },
      "title": "CompactLogix \u00ae, ControlLogix \u00ae, Compact GuardLogix \u00ae and GuardLogix \u00ae Buffer Overflow",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
    "assignerShortName": "Rockwell",
    "cveId": "CVE-2025-12011",
    "datePublished": "2026-07-14T15:03:11.708Z",
    "dateReserved": "2025-10-21T12:56:46.593Z",
    "dateUpdated": "2026-07-14T15:26:29.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-12012 (GCVE-0-2025-12012)

Vulnerability from cvelistv5 – Published: 2026-07-14 15:04 – Updated: 2026-07-14 15:26

Title

CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow

Summary

A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

Rockwell

References

1 reference

URL	Tags
https://www.rockwellautomation.com/en-us/trust-ce…

Impacted products

1 product

Vendor	Product	Version
Rockwell Automation	CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570	Affected: V34.012 and earlier V35.011 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-12012",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T15:25:51.670680Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T15:26:00.338Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "CompactLogix\u00ae 5370      Compact GuardLogix\u00ae 5370      ControlLogix\u00ae 5570      GuardLogix\u00ae 5570",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "V34.012 and earlier V35.011 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A denial-of-service issue exists in\u0026nbsp;5380/5480/5580\u0026nbsp;controllers.\u0026nbsp;This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to\u0026nbsp;enter a major non-recoverable fault (MNRF).\u0026nbsp;"
            }
          ],
          "value": "A denial-of-service issue exists in\u00a05380/5480/5580\u00a0controllers.\u00a0This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to\u00a0enter a major non-recoverable fault (MNRF)."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:04:18.725Z",
        "orgId": "b73dd486-f505-4403-b634-40b078b177f0",
        "shortName": "Rockwell"
      },
      "references": [
        {
          "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html"
        }
      ],
      "source": {
        "advisory": "SD1781",
        "discovery": "INTERNAL"
      },
      "title": "CompactLogix \u00ae, ControlLogix \u00ae, Compact GuardLogix \u00ae and GuardLogix \u00ae Buffer Overflow",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
    "assignerShortName": "Rockwell",
    "cveId": "CVE-2025-12012",
    "datePublished": "2026-07-14T15:04:18.725Z",
    "dateReserved": "2025-10-21T12:58:15.696Z",
    "dateUpdated": "2026-07-14T15:26:00.338Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9636 (GCVE-0-2026-9636)

Vulnerability from cvelistv5 – Published: 2026-07-14 15:11 – Updated: 2026-07-14 15:55

Title

Rockwell Automation CompactLogix® 5380 ControlLogix® 5580 / 1756-EN4 Communications Module – Certificate Revocation List Vulnerability

Summary

A security issue exists within CompactLogix® 5380, ControlLogix® 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-299 - Improper check for certificate revocation

Assigner

Rockwell

References

1 reference

URL	Tags
https://www.rockwellautomation.com/en-us/trust-ce…

Impacted products

1 product

Vendor	Product	Version
Rockwell Automation	ControlLogix® 5580, CompactLogix® 5380, GuardLogix® 5580, Compact GuardLogix® 5380, 1756-EN4TR	Affected: Version 36 - Version 37

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9636",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-14T15:54:57.625184Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T15:55:05.004Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ControlLogix\u00ae 5580, CompactLogix\u00ae 5380, GuardLogix\u00ae 5580, Compact GuardLogix\u00ae 5380, 1756-EN4TR",
          "vendor": "Rockwell Automation",
          "versions": [
            {
              "status": "affected",
              "version": "Version 36 - Version 37"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A security issue exists within CompactLogix\u00ae 5380, ControlLogix\u00ae 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections."
            }
          ],
          "value": "A security issue exists within CompactLogix\u00ae 5380, ControlLogix\u00ae 5580, and EN4 communication modules related to CIP Security certificate revocation handling. The security issue stems from the controller failing to properly reject certificates signed by an intermediate certificate that has been revoked via a Certificate Revocation List (CRL). This could allow a network-based attacker to establish a connection using a certificate that should be untrusted, potentially bypassing CIP Security protections."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-299",
              "description": "CWE-299 Improper check for certificate revocation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T15:11:42.995Z",
        "orgId": "b73dd486-f505-4403-b634-40b078b177f0",
        "shortName": "Rockwell"
      },
      "references": [
        {
          "url": "https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1788.html"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to firmware version 38.011 or later.\u003cbr\u003e\u003cbr\u003eFor\u0026nbsp;1756-EN4TR upgrade to version 8.001 or later."
            }
          ],
          "value": "Upgrade to firmware version 38.011 or later.\n\nFor\u00a01756-EN4TR upgrade to version 8.001 or later."
        }
      ],
      "source": {
        "advisory": "SD1788",
        "discovery": "INTERNAL"
      },
      "title": "Rockwell Automation CompactLogix\u00ae 5380 ControlLogix\u00ae 5580 / 1756-EN4 Communications Module \u2013 Certificate Revocation List Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b73dd486-f505-4403-b634-40b078b177f0",
    "assignerShortName": "Rockwell",
    "cveId": "CVE-2026-9636",
    "datePublished": "2026-07-14T15:11:42.995Z",
    "dateReserved": "2026-05-26T18:10:55.329Z",
    "dateUpdated": "2026-07-14T15:55:05.004Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-2338

CVE-2025-11698 (GCVE-0-2025-11698)

CVE-2025-12011 (GCVE-0-2025-12011)

CVE-2025-12012 (GCVE-0-2025-12012)

CVE-2026-9636 (GCVE-0-2026-9636)

Tags

Sightings

Nomenclature