Which versions of Micro850/Micro870 PLCs are affected by CVE-2025-13823?

Rockwell Automation Micro850 and Micro870 programmable logic controllers are vulnerable to denial-of-service attacks that render affected devices inoperable until manual intervention restores them.

How to fix or mitigate CVE-2025-13823?

Within 24 hours, conduct an inventory of all Rockwell Automation Micro850 and Micro870 PLCs in your environment, documenting their locations, firmware versions, and network segments; brief operations teams on manual recovery procedures for fault code 0xFE60. Within 7 days, implement network-level mitigations by configuring firewall rules and access control lists to restrict IPv6 traffic from untrusted adjacent network segments to these controllers, and deploy monitoring to alert on fault code 0xFE60 events for rapid incident response. Within 30 days, establish a vendor engagement plan with Rockwell Automation to track patched firmware availability, and assess whether deploying replacement PLCs with hardened IPv6 implementations aligns with your operational continuity requirements and risk tolerance.

Micro850/Micro870 PLCs CVE-2025-13823

Q: What is the CVSS score of CVE-2025-13823?

CVE-2025-13823 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

2025-12-15 PSIRT@rockwellautomation.com

Denial Of Service

7.1

CVSS 4.0 · Vendor: rockwellautomation

Severity by source

Vendor (rockwellautomation) PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Adjacent-network only (AV:A), no privileges or interaction needed, exclusively high availability impact with no C or I effects.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (rockwellautomation).

CVSS VectorVendor: rockwellautomation

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 03, 2026 - 03:40 vuln.today

tag: Information Disclosure replaced by Denial Of Service

Analysis Generated

Sep 03, 2026 - 03:35 vuln.today

CVE Published

Dec 15, 2025 - 16:15 cve.org

HIGH 7.1

DescriptionCVE.org

A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packets during fuzzing. The controllers will go into recoverable fault with fault code 0xFE60. To recover the controller, clear the fault.

AnalysisAI

Rockwell Automation Micro850 and Micro870 programmable logic controllers enter a recoverable fault state (fault code 0xFE60) when their IPv6 stack processes multiple malformed packets from an adjacent network segment. The impact is purely an availability disruption requiring manual operator intervention to clear the fault - no confidentiality or integrity compromise occurs. This is particularly significant in OT/ICS environments where controller downtime can halt industrial processes, though the fault is described as recoverable rather than bricking the device.

Technical ContextAI

The Micro850 and Micro870 are Allen-Bradley micro-programmable logic controllers (PLCs) manufactured by Rockwell Automation, commonly deployed in industrial automation and OT environments. The vulnerability resides in the IPv6 network stack implementation on these controllers. When the IPv6 parser receives a sequence of malformed (crafted/fuzzed) packets, it fails to handle the malformed input gracefully and triggers an internal fault condition rather than dropping the packets. Fault code 0xFE60 is a controller-level recoverable fault that halts normal operation until cleared by an operator. The CVSS 4.0 vector (AV:A) confirms exploitation requires adjacent-network access - the attacker must be on the same network segment or VLAN as the controller, consistent with typical OT flat-network or segmented-LAN topologies. No CWE is assigned, but the behavior is consistent with improper input validation (CWE-20) or an unhandled exception in the IPv6 packet-processing path.

Affected ProductsAI

Rockwell Automation Micro850 and Micro870 series PLCs are affected when IPv6 is active. Specific firmware version ranges are not enumerated in the available data; exact affected versions should be confirmed via the vendor advisory at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1766.html. No CPE strings are provided in the input data, so version-range confirmation requires consulting the Rockwell Automation SD1766 advisory directly.

RemediationAI

Consult Rockwell Automation Security Advisory SD1766 at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1766.html for firmware patch details and exact fixed versions, which are not enumerated in the currently available data. As an immediate compensating control, disable IPv6 on Micro850/Micro870 controllers if IPv6 connectivity is not operationally required - this eliminates the attack surface entirely but may affect network management workflows that depend on IPv6 addressing. Where IPv6 must remain enabled, enforce network segmentation and restrict adjacency using managed switches with VLAN isolation to ensure only authorized engineering stations can reach controller IPv6 interfaces; this reduces the attacker pool but does not eliminate the vulnerability. Apply Rockwell's defense-in-depth guidance for ICS environments: place controllers behind an industrial DMZ, monitor for anomalous IPv6 traffic patterns, and establish procedures for rapid fault-code response (fault code 0xFE60 requires manual clearance via the programming software or keyswitch cycle).