Logix Controllers CVE-2025-12012

Exploitation requires network reachability to the affected Rockwell Logix controller's file-handling/CIP communication interface; per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) no authentication, no special attack requirement, and no user interaction are needed, so any attacker able to send messages to the controller can attempt it. The concrete prerequisite is the ability to write file data to the controller - the attacker must reach the service that accepts file/program data and supply malformed content. The primary limiting factor is deployment: Logix controllers are typically on isolated OT/ICS networks, so real-world exploitation depends on the attacker first gaining access to that network segment or the controller's ports being exposed; there is no authentication or user-interaction barrier once the port is reachable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated attack requiring no user interaction - the easiest-to-reach class of flaw - and the 9.2 Critical score is driven entirely by availability impact on both the vulnerable system (VA:H) and a subsequent system (SA:H), reflecting that a controller fault cascades to the physical process it governs. Impact is availability-only: there is no confidentiality or integrity loss (VC:N/VI:N/VI... SC/SI:N), so this is a process-disruption/downtime risk, not data theft or logic manipulation. No EPSS score, KEV listing, or POC was provided, so probabilistic and in-the-wild signals are absent; the practical mitigating factor is that ICS controllers are normally on segmented OT networks not directly exposed to the internet, which meaningfully lowers real-world reachability despite the AV:N rating. In OT terms this is a genuine priority because a single crafted request can non-recoverably fault safety and process controllers, but the network-vector risk is realistic only where the controller's communication ports are reachable by an attacker.

An attacker with network reachability to a Logix controller's CIP/EtherNet/IP service sends a crafted message containing invalid file data that overruns an unvalidated buffer, driving the controller into a Major Non-Recoverable Fault. The controller stops executing its control program, halting the associated process or safety function until an operator manually recovers the device. No public exploit was identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication (PR:N) make reliable triggering plausible for an attacker on the OT network.