Which versions of Logix Controllers are affected by CVE-2025-12012?

Rockwell Automation Logix programmable controllers are vulnerable to a critical flaw (CVE-2025-12012, CVSS 9.2) that allows remote unauthenticated attackers to crash these devices into unrecoverable…

How to fix or mitigate CVE-2025-12012?

Within 24 hours, inventory all Rockwell Automation Logix controller deployments in your environment and implement or verify firewall rules restricting network access to these devices to authorized engineering workstations and control network traffic only. Within 7 days, implement network segmentation to isolate affected controllers from untrusted networks, establish comprehensive network monitoring and alerting for anomalous traffic to these systems, and create a tracking entry for vendor patch availability. Within 30 days, evaluate air-gapping or network isolation for the most critical systems, deploy IDS/IPS systems capable of detecting buffer overflow attack patterns, and maintain regular communication with Rockwell Automation to track patching timelines.

Logix Controllers CVE-2025-12012

Q: What is the CVSS score of CVE-2025-12012?

CVE-2025-12012 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2025-210462 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-07-14 Rockwell

GHSA-3cv6-265j-3gwv

Buffer Overflow Compactlogix 5370 Compact Guardlogix 5370 Controllogix 5570 Guardlogix 5570

9.2

CVSS 4.0 · Vendor: Rockwell

Severity by source

Vendor (Rockwell) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable, low-complexity, unauthenticated write of invalid file data with no UI; impact is availability-only (controller fault), so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:39 vuln.today

CVE Published

Jul 14, 2026 - 15:04 cve.org

CRITICAL 9.2

DescriptionCVE.org

A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).

AnalysisAI

Denial-of-service in Rockwell Automation Logix programmable controllers allows a remote unauthenticated attacker to write invalid file data that forces the device into a Major Non-Recoverable Fault (MNRF), halting the industrial process it controls. Rated CVSS 4.0 9.2 (Critical) with availability as the sole impact, the flaw is a CWE-120 buffer overflow reachable over the network with no privileges or user interaction. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the low attack complexity makes it a high-priority patch for OT environments.

Technical ContextAI

The affected devices are Rockwell Automation (Allen-Bradley) Logix-family programmable automation controllers used in industrial control systems to run ladder/structured-text logic for manufacturing, safety, and process automation. The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input, i.e. a classic buffer overflow) - the controller's file-handling routine accepts externally supplied file data without adequately validating its size or contents, so malformed input overruns a buffer and corrupts controller state. Rather than achieving code execution, the corruption drives the controller into a Major Non-Recoverable Fault (MNRF), a firmware safety state in which the device stops executing its program and must be manually recovered. Note a data conflict: the CVE description names the 5380/5480/5580 controller families, while the supplied CPE string and tags enumerate CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, and GuardLogix 5570 - the exact affected model set should be confirmed against Rockwell advisory SD1781.

RemediationAI

Consult Rockwell Automation Security Advisory SD1781 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html) and apply the fixed controller firmware Rockwell specifies for your exact model; an exact fixed version was not present in the supplied data, so Patch available per vendor advisory but the specific version must be taken from SD1781. Because these are safety/process controllers, schedule the firmware update during a maintenance window and validate against your safety instrumented functions before returning to production. Where immediate patching is not possible, apply OT network segmentation and least-privilege access: place controllers behind an ICS firewall or conduit, restrict the controller's EtherNet/IP and CIP communication ports (e.g. TCP/UDP 44818 and TCP 2222) to only the specific engineering workstations and HMIs that require them, and block all external and untrusted-VLAN access to those ports - the trade-off is that overly tight filtering can disrupt legitimate polling from SCADA/HMI systems, so rules should be validated against known-good traffic. Enable controller change/network monitoring so a fault event is detected quickly, and keep documented MNRF recovery procedures ready since recovery is manual.