Which versions of Logix Controllers are affected by EUVD-2025-210463?

Rockwell Automation CompactLogix and ControlLogix industrial controllers (5380, 5480, 5580 models running firmware below version 1.072) are vulnerable to remote denial-of-service attacks that force…

How to fix or mitigate EUVD-2025-210463?

Within 24 hours: Inventory all CompactLogix 5380/5480, GuardLogix 5380/5580, and ControlLogix 5580 controllers in your environment and document their current boot firmware versions to identify devices running below version 1.072. Within 7 days: Implement network segmentation isolating affected controllers to protected industrial zones, deploy firewall rules blocking unauthorized remote access, and enable intrusion detection monitoring on networks containing vulnerable devices. Within 30 days: Establish a patching workflow with Rockwell Automation to track firmware version 1.072 or later availability, develop and test manual recovery procedures for each device, and implement SCADA monitoring to detect anomalous controller behavior indicating exploitation attempts.

Logix Controllers EUVD-2025-210463

Q: What is the CVSS score of EUVD-2025-210463?

EUVD-2025-210463 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2025-11698 CRITICAL

Classic Buffer Overflow (CWE-120)

2026-07-14 Rockwell

GHSA-w4jq-g2m7-xj78

Buffer Overflow Compactlogix 5380 Recovery Image Compact Guardlogix 5380 Recovery Image Compactlogix 5480 Recovery Image Controllogix 5580 Recovery Image Guardlogix 5580 Recovery Image

9.2

CVSS 4.0 · Vendor: Rockwell

Severity by source

Vendor (Rockwell) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Network-reachable, low-complexity, unauthenticated DoS with no user interaction; scope changes as the controller fault halts the physical process, and only availability is impacted.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 16:01 vuln.today

CVE Published

Jul 14, 2026 - 15:05 cve.org

CRITICAL 9.2

DescriptionCVE.org

A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).

AnalysisAI

Denial-of-service in Rockwell Automation CompactLogix/GuardLogix 5380, CompactLogix 5480, and ControlLogix/GuardLogix 5580 controllers running boot firmware below version 1.072 lets a remote unauthenticated attacker write malformed file data that forces the device into a major non-recoverable fault (MNRF), halting the controlled process until manual recovery. The flaw carries a CVSS 4.0 base of 9.2 driven purely by availability impact (no data confidentiality or integrity loss) and requires no authentication or user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The affected devices are Rockwell Automation programmable automation controllers (PACs) from the Logix family - CompactLogix 5380, Compact GuardLogix 5380, CompactLogix 5480, ControlLogix 5580, and GuardLogix 5580 - where the defect lives in the boot/recovery firmware image (per the single CPE covering the '...recovery image' components). The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input, i.e. a classic buffer overflow) and is tagged 'Buffer Overflow': the firmware copies attacker-supplied file data into a buffer without adequately validating its size or format, so crafted/invalid input overruns the intended bounds and corrupts controller state. Rather than achieving code execution, the overflow drives the controller into an MNRF, a fault state on Logix hardware that requires manual intervention (reflash/recovery) rather than an automatic restart.

RemediationAI

Vendor-released patch: boot firmware version 1.072 or later - upgrade all affected CompactLogix 5380/5480, Compact GuardLogix 5380, ControlLogix 5580, and GuardLogix 5580 controllers to boot firmware 1.072+ following the update procedure in Rockwell advisory SD1781 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html). Because the target is a live process controller, schedule the update during a maintenance window as reflashing boot firmware typically requires taking the controller offline. Until patching is complete, apply network-level compensating controls: place the controllers on a segmented OT/cell network behind a firewall and deny controller management/file-transfer protocols (e.g. CIP/EtherNet-IP over TCP/UDP 44818 and 2222) from untrusted zones, restrict access to only authorized engineering workstations, and monitor for anomalous file-write traffic - the trade-off is that overly aggressive filtering can disrupt legitimate PLC programming and HMI/SCADA polling, so validate rules against normal traffic before enforcing.