Rockwell Automation Vulnerabilities Under Active Exploitation

Multiple Rockwell Automation products are vulnerable to denial-of-service conditions and arbitrary code execution, according to recent advisories from CISA, highlighting the ongoing threat to industrial control systems.

Understanding the Vulnerabilities

The vulnerabilities, identified as CVE-2025-12011, CVE-2025-12012, and CVE-2025-11698, affect various versions of Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix, and GuardLogix products. These vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code in the context of the current process.

Attack Vector

The attack vector involves exploiting these vulnerabilities to gain unauthorized access to the affected products, potentially allowing attackers to disrupt or take control of industrial control systems. This is reminiscent of past incidents, such as the Stuxnet worm, which targeted industrial control systems using zero-day vulnerabilities.

Who Is Affected

The following versions of Rockwell Automation products are affected:

• CompactLogix 5370 <=V35.015
• Compact GuardLogix 5370 <=V35.015
• ControlLogix 5570 <=V35.015
• GuardLogix 5570 <=V35.015
• CompactLogix 5380 <=V34.012

These products are commonly used in industrial control systems across various sectors, including manufacturing, energy, and transportation.

What the Sceptics Say

Some may argue that the vulnerabilities are not as severe as reported, given that patches are already available for some of the affected products. However, the fact that these vulnerabilities have been identified and are potentially being exploited highlights the ongoing need for vigilance and proactive security measures in the industrial control systems sector.

How to Defend

To defend against these vulnerabilities, users should:

• Apply available patches to affected products as soon as possible.
• Implement robust network segmentation to limit the attack surface.
• Monitor systems for suspicious activity, such as unexpected network traffic or system crashes.

Additionally, users can refer to the MITRE ATT&CK framework for guidance on detecting and mitigating potential attacks.

Key Takeaways

1. Security Teams: Prioritize patching and monitoring of affected systems, and implement robust network segmentation to limit the attack surface.
2. CISOs: Ensure that incident response plans are in place and that teams are prepared to respond to potential attacks on industrial control systems.
3. Developers: Incorporate secure coding practices and conduct regular security testing to identify and address potential vulnerabilities in industrial control systems.
4. End Users: Be aware of the potential risks associated with industrial control systems and report any suspicious activity to their organization's security team.

Sources

• CISA Advisories: Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix
• CISA Advisories: Rockwell Automation FactoryTalk DataMosaix
• CISA Advisories: Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT