As reported by CISA via ICS Advisory ICSA-26-197-06, three denial-of-service vulnerabilities have been disclosed affecting a broad swath of Rockwell Automation's Logix programmable logic controller (PLC) families — some of the most widely deployed industrial controllers in manufacturing, energy, water treatment, and critical infrastructure globally.
Vulnerability Snapshot
- CVE-2025-12011
- Denial-of-service vulnerability; affects all listed Logix controller families at or below patched firmware thresholds. Severity: High (CVSS pending confirmation from vendor advisory).
- CVE-2025-12012
- Denial-of-service vulnerability; same affected product scope. Likely network-accessible attack vector given PLC communication architecture.
- CVE-2025-11698
- Denial-of-service vulnerability; affects all listed product lines. May involve malformed EtherNet/IP or CIP protocol handling — a common attack surface for Logix controllers.
| Product Family | Affected Versions | CVEs |
|---|---|---|
| CompactLogix 5370 / Compact GuardLogix 5370 | <= V35.015 | CVE-2025-12011, -12012, -11698 |
| ControlLogix 5570 / GuardLogix 5570 | <= V35.015 | CVE-2025-12011, -12012, -11698 |
| CompactLogix 5380 / Compact GuardLogix 5380 | <= V34.012 and <= V35.011 | CVE-2025-12011, -12012, -11698 |
| CompactLogix 5480 | <= V34.012 and <= V35.011 | CVE-2025-12011, -12012, -11698 |
Patch Available: Yes — firmware updates from Rockwell Automation. Consult the vendor's official security advisory and the CISA advisory for specific remediated version numbers.
Active Exploitation in the Wild: Not confirmed at time of publication, though OT environments are increasingly targeted by both criminal and nation-state actors.
Why This Matters Beyond the Patch Notes
DoS vulnerabilities in OT environments carry consequences that are categorically different from those in enterprise IT. A crashed PLC doesn't just take down a server — it can halt an assembly line, interrupt water treatment dosing, disrupt power grid switching logic, or disable safety instrumented systems (SIS). The inclusion of GuardLogix variants is particularly concerning: these controllers are specifically designed for functional safety applications, meaning a successful exploit could directly undermine the last line of defense in high-consequence industrial processes.
The breadth of affected hardware across multiple 5000-series product generations suggests these are not edge-case configurations. Rockwell Automation's Logix platform commands significant market share in North American and European industrial automation. Organizations across automotive, food and beverage, pharmaceuticals, oil and gas, utilities, and discrete manufacturing are all exposed.
The convergence of IT and OT networks over the past decade has dramatically expanded the attack surface for vulnerabilities like these. Controllers that were once air-gapped now routinely communicate over Ethernet — and that connectivity is precisely what these CVEs likely exploit.
The Threat Actor Angle
Even absent confirmed exploitation, the disclosure of three simultaneous DoS vectors against the same controller family represents a meaningful intelligence win for adversaries conducting reconnaissance on industrial targets. Nation-state actors — particularly those focused on pre-positioning within critical infrastructure — actively catalog OT vulnerabilities for potential future use. The window between public disclosure and exploitation attempts in OT environments is shrinking as threat actors develop more mature ICS capabilities.
Shield53 Recommendations — Immediate Actions
Priority 1: Patch
Priority 2: Network Segmentation and Access Control
- If patching cannot be performed immediately, restrict network access to affected controllers using industrial firewalls or unidirectional gateways. Apply allowlisting for EtherNet/IP (TCP/UDP 44818) and CIP traffic.
- Ensure OT network segments are properly isolated from corporate IT and internet-facing systems per IEC 62443 zone and conduit principles.
- Disable remote access to controllers where not operationally required.
Priority 3: Detection and Monitoring
- Deploy OT-aware network monitoring (e.g., Claroty, Dragos, Nozomi) to detect anomalous CIP traffic patterns that could indicate exploitation attempts.
- Establish alerting for unexpected controller faults, unexpected mode changes, or repeated connection attempts from unknown sources.
- Review historian and SCADA logs for any unusual communication patterns around the time of this disclosure.
Priority 4: Incident Readiness
- Ensure your OT incident response runbook includes procedures for PLC reboot and recovery without loss of process state.
- Validate that manual operational fallback procedures are documented and staff are trained — a successful DoS against a safety controller may require immediate human intervention.
The CISA advisory should be treated as a forcing function for organizations that have deferred OT patching programs. Rockwell Automation's Logix platform is foundational infrastructure — treat these vulnerabilities with the same urgency you would apply to a critical vulnerability in your enterprise firewall or Active Directory environment.
