Rockwell Automation Device CVE-2025-9177

Exploitation requires network reachability to the affected Rockwell Automation device's embedded web server and the ability to send a high volume of requests to it; per CVSS PR:N/UI:N no authentication or user interaction is needed against the exposed web interface. Limiting factors: impact is confined to the web management interface - the advisory explicitly states I/O control and communication are NOT affected - so the practical consequence is loss of the webpage, and recovery requires physical/manual power-cycle access rather than offering the attacker any code execution, data access, or control-system disruption. Real-world exposure is further limited where the device web server is segmented off untrusted networks, which is standard OT practice.

Signals are largely consistent in pointing to a moderate, availability-only risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated flaw, which is why the base score lands at 7.7; however, the only non-zero impact is SA:H (subsequent-system availability), with VC:N/VI:N/VA:N - i.e., no confidentiality or integrity impact and no direct impact on the vulnerable component itself, consistent with the CWE-770 resource-exhaustion / DoS nature. EPSS is low at 0.32% (23rd percentile), and the CVE is NOT in CISA KEV with no public exploit identified, so despite the network-facing unauthenticated vector this is not evidence of widespread or active exploitation. Note a signal nuance to verify with the vendor: the 4.0 vector encodes availability impact as SA:H (subsequent system) while VA:N (vulnerable system is unaffected) - this is an unusual split for a web-server crash and suggests the scoring party treated the device/process as the impacted subsequent system; functionally the real effect is loss of the web management interface. The description's own mitigating statement - that I/O control and communication are NOT affected - materially lowers operational risk in an OT context, so this reads as a genuine-but-contained availability issue rather than a top-priority critical, with the main concern being that recovery requires a manual power cycle.

A remote, unauthenticated attacker with network reachability to the device's embedded web server floods it with a high volume of requests, exhausting resources until the web server crashes. The management webpage becomes unavailable and, per the advisory, a physical power cycle is required to restore it; underlying I/O control and communication continue to function. No public exploit code has been identified, but the low complexity makes a crafted request-flooding script trivial to produce.