CVE-2025-12011

CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow

Published Jul 14, 2026 CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Description

A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).

Analysis

Technical impact

A buffer overflow flaw permits a remote user to load a malformed project file into a CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, or GuardLogix 5570 controller, causing the device to enter a major non‑recoverable fault and terminating all operations. The resulting denial of service requires a manual reset or firmware re‑installation. The weakness is the classic CWE‑120 buffer overflow.

Affected Systems

Rockwell Automation CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, and GuardLogix 5570 controllers are affected.

Risk and Exploitability

The CVSS score of 9.2 indicates critical severity. The EPSS score of <1% suggests a low probability of public exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a remote client sending a crafted project file over the controller’s network interface.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Rockwell Automation

CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570

unaffected

Version	Status	Constraints
`35.015 and earlier`	affected	—

No data.

Vendor Product Versions

Rockwellautomation

Compact Guardlogix 5370

Version	Status	Scheme	Platform
`[0,35.015]`	affected	generic	—

Rockwellautomation

Compactlogix 5370

Version	Status	Scheme	Platform
`[0,35.015]`	affected	generic	—

Rockwellautomation

Controllogix 5570

Version	Status	Scheme	Platform
`[0,35.015]`	affected	generic	—

Rockwellautomation

Guardlogix 5570

Version	Status	Scheme	Platform
`[0,35.015]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest firmware update or patch released by Rockwell Automation for the affected CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, and GuardLogix 5570 controllers.
Block or restrict the controller’s management network interface using firewall rules or network segmentation, preventing external devices from transmitting project files.
If a vendor patch is not yet available, disable the project‑load feature or configure the controller to allow project loading only from trusted internal sources.

Generated by OpenCVE AI on July 31, 2026 at 10:18 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.428% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html

History

Aug 18, 2026 6:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Rockwell Automation Rockwell Automation compactlogix 5370 Compact Guardlogix 5370 Controllogix 5570 Guardlogix 5570
CPEs		cpe:2.3:a:rockwell_automation:compactlogix_5370_compact_guardlogix_5370_controllogix_5570_guardlogix_5570:35.015_and_earlier:::::::*
Vendors & Products		Rockwell Automation Rockwell Automation compactlogix 5370 Compact Guardlogix 5370 Controllogix 5570 Guardlogix 5570

Jul 27, 2026 3:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Rockwellautomation Rockwellautomation compact Guardlogix 5370 Rockwellautomation compactlogix 5370 Rockwellautomation controllogix 5570 Rockwellautomation guardlogix 5570
Vendors & Products		Rockwellautomation Rockwellautomation compact Guardlogix 5370 Rockwellautomation compactlogix 5370 Rockwellautomation controllogix 5570 Rockwellautomation guardlogix 5570

Jul 14, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 14, 2026 3:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).
Title		CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow
Weaknesses		CWE-120
References		https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html
Metrics		cvssV4_0 `{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H'}`