Logix Controllers CVE-2025-11698

Exploitation requires network reachability to a controller running boot firmware below version 1.072 and the ability to write file data to it, targeting the CompactLogix 5380/5480, Compact GuardLogix 5380, or ControlLogix/GuardLogix 5580 platforms. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special configuration, and no user interaction are required, so any actor able to reach the controller's file-write/management interface can trigger the fault. The primary limiting factor is network exposure: these are OT process controllers normally deployed on segmented industrial networks, so realistic exploitation depends on the attacker first gaining access to that OT segment, and only firmware versions below 1.072 are vulnerable.

The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction, which correctly yields a high 9.2 score - but that score is entirely availability-weighted (VA:H, SA:H) with zero confidentiality or integrity impact, so this is a pure DoS, not RCE. There is no EPSS score, no POC, and no CISA KEV entry provided, so exploitation is not confirmed in the wild; the score reflects potential ease of exploitation rather than observed activity. The realistic priority is nonetheless high for operational-technology environments because the impact is a non-recoverable fault requiring physical/manual recovery of a process controller, and many OT networks assume flat, unauthenticated internal reachability. Key caveat: real exposure hinges on network segmentation - if these controllers are properly isolated on an OT network per Rockwell/IEC 62443 guidance, the practical AV:N reachability is greatly reduced; verify segmentation before treating this as internet-exploitable.

An attacker with network reachability to an unpatched Logix controller sends crafted file data over the controller's file-transfer/management interface, and because the boot firmware fails to validate the input size (CWE-120), the malformed data triggers a buffer overflow. Given AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed, and the controller is driven into a major non-recoverable fault that stops the controlled physical process until an operator manually recovers the device. No public exploit code has been identified at time of analysis.