Which versions of Rockwell Automation Controller are affected by CVE-2025-13824?

Production environments running Rockwell Automation controllers face uncontrolled downtime risk: attackers can crash devices remotely without authentication, requiring manual recovery that interrupts…

How to fix or mitigate CVE-2025-13824?

Within 24 hours: conduct an inventory of all Rockwell Automation controllers and their network connectivity; implement firewall rules to restrict CIP (Common Industrial Protocol) traffic to only authorized sources and consider network segmentation if controllers are internet-adjacent. Within 7 days: deploy network intrusion detection signatures to monitor for malformed CIP packets; verify fault-code clearing procedures (0xF019) are documented and tested with operations teams. Within 30 days: actively monitor vendor advisories for security patches; develop redundancy or failover plans for critical controllers that cannot be adequately isolated.

Rockwell Automation Controller CVE-2025-13824

Q: What is the CVSS score of CVE-2025-13824?

CVE-2025-13824 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

HIGH

Release of Invalid Pointer or Reference (CWE-763)

2025-12-15 PSIRT@rockwellautomation.com

Denial Of Service

8.7

CVSS 4.0 · Vendor: rockwellautomation

Severity by source

Vendor (rockwellautomation) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

CIP service is network-reachable with no authentication required; impact is availability-only (hard fault/DoS), no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (rockwellautomation).

CVSS VectorVendor: rockwellautomation

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Metadata Corrected

Sep 03, 2026 - 03:40 vuln.today

tag: Information Disclosure replaced by Denial Of Service

Analysis Generated

Sep 03, 2026 - 03:36 vuln.today

CVE Published

Dec 15, 2025 - 16:15 cve.org

HIGH 8.7

DescriptionCVE.org

A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and reports fault code 0xF019. To recover, clear the fault.

AnalysisAI

Unauthenticated denial-of-service in a Rockwell Automation controller allows remote attackers to trigger a hard fault by sending malformed CIP (Common Industrial Protocol) packets over the network, rendering the controller completely unresponsive. The device displays a solid red Fault LED and requires a physical power cycle followed by manual fault-code clearing (0xF019) before returning to operational state. Discovered during fuzzing, this vulnerability targets OT/ICS environments where controller availability is safety-critical; no active exploitation or public exploit code has been identified at time of analysis.

Technical ContextAI

CIP (Common Industrial Protocol) is the application-layer protocol used by Rockwell Automation (Allen-Bradley) controllers for industrial automation communications, typically transported over EtherNet/IP on TCP/UDP port 44818. The root cause is classified as CWE-763 (Release of Invalid Pointer or Reference), suggesting the controller firmware fails to validate CIP packet structure before processing, leading to a memory-level fault - likely a null or invalid pointer dereference - that triggers the processor's hard fault exception handler. Unlike a graceful software exception, a hard fault at the firmware level causes the controller to halt all execution and signal the error via LED indicators (solid red Fault LED). Upon power cycle, the controller enters a recoverable fault mode (MS LED and Fault LED flashing red, fault code 0xF019) that requires an explicit fault-clear command before normal operation resumes. The affected product is identified via Rockwell Automation PSIRT advisory SD1766, though the specific controller family and firmware version range are not disclosed in the available data.

Affected ProductsAI

The vulnerability affects one or more Rockwell Automation controller models whose CIP stack improperly handles malformed packets. The specific controller family, product line, and affected firmware version range are not identified in the available data - the NVD reference points to Rockwell Automation security advisory SD1766 at rockwellautomation.com, which is the authoritative source for affected CPE and version ranges. No CPE string was provided in the input data.

RemediationAI

Consult Rockwell Automation security advisory SD1766 at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1766.html for the official patch version and upgrade instructions, as a specific fixed firmware version is not available in the current input data. Until patching is confirmed, restrict network access to CIP/EtherNet/IP services (TCP/UDP port 44818) using industrial firewalls or DMZ segmentation so that only authorized engineering workstations and HMIs can reach the controller's CIP endpoint - this directly eliminates the unauthenticated network attack vector. Where deep packet inspection is available on industrial switches (e.g., Rockwell Stratix or Cisco IE series), enable CIP protocol filtering to block or alert on malformed CIP command codes. Physical access controls to the control panel should be verified independently, as recovery from a hard fault requires a power cycle. Note that CIP filtering may affect legitimate SCADA/HMI polling if misconfigured; test in a staging environment before production deployment.