Security readout for executives and security teams
Plain-English summary
A remote user could load a malformed project onto affected Rockwell Automation controllers, forcing a major non-recoverable fault and disrupting operations. The issue affects specified 5370 and 5570 controller families running version 35.015 or earlier. The supplied evidence identifies availability impact, not data theft or unauthorized process modification.
Executive priority
Treat this as urgent for operational technology environments using the affected controllers. Prioritize inventory, access restriction, and vendor-guided remediation because successful triggering could interrupt controller and downstream availability. Escalate systems supporting safety-critical or production-critical processes first, while avoiding claims of active exploitation unsupported by the sources.
Technical view
CVE-2025-12011 is a CWE-120 buffer overflow in affected CompactLogix, Compact GuardLogix, ControlLogix, and GuardLogix controllers. A remotely supplied invalid project can trigger an MNRF. CVSS 4.0 is 9.2: network-accessible, low complexity, no privileges or user interaction, with high vulnerable-system and downstream availability impact.
Likely exposure
Exposure is limited to the named 5370 and 5570 controller families at version 35.015 or earlier. Risk is greatest where systems capable of loading controller projects can reach these devices remotely or where engineering access is insufficiently restricted. The bundle does not identify exposed deployments or affected organizations.
Exploitation context
The supplied bundle does not report active exploitation, and the CVE is not marked as CISA KEV. It establishes a remotely triggerable denial-of-service condition requiring an invalid project load. No exploit availability, observed attacks, or attacker campaign details are provided.
Researcher notes
The evidence supports a buffer-overflow-driven availability failure through malformed project loading. The CVSS vector reports no confidentiality or integrity impact but high vulnerable-system and subsequent-system availability impact. Exact protocol, vulnerable component, fault recovery requirements, patch version, and proof-of-concept status are not stated in the supplied bundle.
Mitigation direction
- Inventory the named controller families and record their installed firmware versions.
- Review Rockwell Automation advisory SD1781 for vendor-approved remediation or upgrade guidance.
- Restrict project-loading access to authorized, managed engineering systems.
- Segment controller networks and block unnecessary access from untrusted networks.
- Prepare operational recovery procedures for controllers entering an MNRF state.
Validation and detection
- Confirm whether each controller is version 35.015 or earlier.
- Verify only authorized engineering systems can reach project-loading interfaces.
- Check network controls separating controller environments from untrusted networks.
- Review logs and change records for unexpected project-loading activity.
- Confirm vendor guidance has been applied and documented for every affected controller.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-120: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-12011 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.2 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H——RockwellVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.htmlCVE reference, Rockwell
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.