Rockwell Automation CompactLogix 5370 and ControlLogix 5570 Can Be Forced into Non-Recoverable Fault by Invalid Project File Write

Last refreshed2026-10-07

Status: UPDATED | Advisory ID: CVE-2025-12011

Key Details

CVE	CVE-2025-12011
CVSS Score / Version	9.2 (Critical) / CVSS v4.0
Updated	2026-09-29
Affected products	Rockwell Automation CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570
Classified as	CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
Exploitation prediction (EPSS)	0.43% probability of exploitation in the next 30 days (35% percentile) -- FIRST.org's EPSS model.

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
Rockwell Automation	CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570

Vendor

Product

Affected Versions

Patch Status

Rockwell Automation

CompactLogix® 5370 Compact GuardLogix® 5370 ControlLogix® 5570 GuardLogix® 5570

Subsystems	General OT
Sectors	Multiple

What to Know

A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF). (NVD)

What to Do

Monitor Rockwell Automation's web page for any future patch releases.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2025-12011
CVE	https://www.cve.org/CVERecord?id=CVE-2025-12011

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-12011

CVE