Rockwell Logix Controllers CVE-2025-12011

Exploitation requires network reachability to a CompactLogix 5370 / Compact GuardLogix 5370 / ControlLogix 5570 / GuardLogix 5570 controller and the ability to send it a project 'load'/download over its programming/EtherNet-IP interface; the trigger is specifically an invalid project file that the controller attempts to parse, causing a Major Non-Recoverable Fault (MNRF). Per the vendor CVSS 4.0 vector (PR:N/UI:N/AT:N) no authentication or user interaction is required, but exploitation is limited to environments where the controller's programming path is reachable by the attacker - in a correctly segmented ICS with the keyswitch in RUN or download access restricted, the attack surface is substantially reduced. Recovery requires manual intervention (MNRF is non-recoverable without operator action), which is the core impact rather than a precondition.

The Rockwell CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity attack with no privileges or interaction, and impact scoped purely to availability of the controller (VA:H) and the subsequent physical process (SA:H) - there is no confidentiality or integrity impact. This is consistent with the description: the outcome is a fault/halt, not RCE or data theft. However, PR:N should be read in ICS context - exploitation still requires network reachability to the controller and the ability to send it a project download, which in a properly segmented plant should not be exposed to untrusted networks. EPSS is not provided and the CVE is not in CISA KEV, and no POC is referenced, so real-world exploitation probability is currently unquantified; the high score is driven by safety/availability consequence, not by evidence of active exploitation. Net: high-priority patch candidate for OT asset owners because of MNRF impact on safety controllers, but real exposure depends heavily on network segmentation.

An attacker with network reachability to an exposed Logix controller (e.g., a flat OT network or an internet-exposed EtherNet-IP interface) sends a crafted, invalid project download to the controller. The malformed data overruns a firmware parsing buffer and drives the controller into a Major Non-Recoverable Fault, stopping the controlled process and, for GuardLogix units, dropping the safety function until an operator manually clears the fault and reloads a valid project. No public exploit code is referenced, so this would require the attacker to develop the malformed-project payload.