Security readout for executives and security teams
Plain-English summary
CVE-2025-11694 affects Rockwell Automation 1769 CompactLogix 5370 controllers running V36. A remote, unauthenticated attacker could abuse exposed protocol connection identifiers to cause a denial-of-service condition that results in a minor controller fault. For operational environments, the concern is process disruption rather than data theft.
Executive priority
Treat this as a high-priority operational resilience issue for sites using CompactLogix 5370 V36. Prioritize exposure reduction and vendor guidance review before broad testing, because production PLC validation can itself create availability risk.
Technical view
The issue is missing validation of CIP sequence numbers and source IP addresses. Connection IDs visible through the web interface can be abused over the network to affect controller availability. The CVSS 4.0 score is 8.7, driven by network reachability, low complexity, no privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is most likely where CompactLogix 5370 V36 controllers have reachable CIP services or web interfaces from untrusted plant, corporate, vendor, or remote-access networks. The bundle names V36 as affected and does not identify other affected versions.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The vulnerability is still operationally important because it is remotely reachable, unauthenticated, and targets controller availability in industrial environments.
Researcher notes
Evidence is limited to the CVE source bundle and Rockwell advisory reference. The bundle identifies CWE-354, affected V36, CVSS 8.7, and denial-of-service impact. It does not provide proof of exploitation, detailed patch status, or safe reproduction guidance.
Mitigation direction
- Check Rockwell advisory SD1776 for vendor-approved updates, mitigations, and affected-version detail.
- Restrict controller web interfaces to trusted engineering workstations and management networks.
- Segment CIP traffic from corporate, vendor, guest, and internet-reachable networks.
- Review remote-access paths that can reach affected controller networks.
- Monitor controllers for unexpected minor faults and availability anomalies.
- Avoid unapproved active testing against production controllers.
Validation and detection
- Inventory 1769 CompactLogix 5370 controllers and confirm firmware version V36 exposure.
- Map network reachability to controller web interfaces and CIP services.
- Review firewall, ACL, VPN, and jump-host rules for unnecessary access paths.
- Check controller and operations logs for unexplained minor faults.
- Confirm whether Rockwell advisory SD1776 lists updates or compensating controls.
- Document any unsupported or unpatchable controllers for risk acceptance planning.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-354: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-11694 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——RockwellVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1776.htmlCVE reference, Rockwell
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Validation of Integrity Check Value
Improper Validation of Integrity Check Value represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.