CVE-2025-12011

highPriorität · verfolgen · 0EPSS 0.004 · 37. PerzentilDEEURUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.43% (37th) EPSS
CVSS 8.6 · high
Is it mine?
58 products
Prüfe deine Angriffsfläche
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

A denial-of-service issue exists in  5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenCompact GuardLogix 5370cisa_csaf_ot

    Compact GuardLogix 5370: Update to V35.016, V36.011 and later

  • BehobenCompact GuardLogix 5380cisa_csaf_ot

    Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

  • BehobenCompact GuardLogix 5380 Recovery Imagecisa_csaf_ot

    Compact GuardLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

  • BehobenCompactLogix 5370cisa_csaf_ot

    Rockwell Automation recommend updating to the following: CompactLogix 5370: Update to V35.016, V36.011 and later

  • BehobenCompactLogix 5380cisa_csaf_ot

    CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

  • BehobenCompactLogix 5380 Recovery Imagecisa_csaf_ot

    CompactLogix 5380 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

  • BehobenCompactLogix 5480cisa_csaf_ot

    CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

  • BehobenCompactLogix 5480 Recovery Imagecisa_csaf_ot

    CompactLogix 5480 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

  • BehobenControlLogix 5570cisa_csaf_ot

    ControlLogix 5570: Update to V35.016, V36.011 and later

  • BehobenControlLogix 5580cisa_csaf_ot

    ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

  • BehobenControlLogix 5580 Recovery Imagecisa_csaf_ot

    ControlLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

  • BehobenGuardLogix 5570cisa_csaf_ot

    GuardLogix 5570: Update to V35.016, V36.011 and later

  • BehobenGuardLogix 5580cisa_csaf_ot

    GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

  • BehobenGuardLogix 5580 Recovery Imagecisa_csaf_ot

    GuardLogix 5580 Recovery Image: Update to boot firmware 1.072 or greater. If using V36.013, V37.011 or later, already has corrected boot firmware is installed

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.2
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.7–9.2

v3.18.6highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · CISA US
v3.18.6highAV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU
v4.09.2criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:Hsecondary · ENISA EU
v4.09.2criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · PSIRT@rockwellautomation.com
v4.07.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-120USCWE-120USCWE-120US
05

betroffene Produkte (58)

Betroffene Produkte und Versionsbereiche.

20 von 58 angezeigt
06

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • WID-SEC-W-2026-2338Rockwell Automation CompactLogix und ControlLogix: Mehrere SchwachstellenDeutsch2026-07-14csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Rockwell Automation CompactLogix und Rockwell Automation ControlLogix ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.

  • ICSA-26-197-06Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix2026-07-16icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducert_bundcisa_csaf_otNVDCVE.orgMITRE
veröffentlicht 2026-07-14geändert 2026-07-17
09

Referenzen (3)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan