# CVE-2025-12011: Rockwell Automation Logix Controllers buffer overflow in project loading

Source: https://junglewise.ai/threats/cve-2025-12011-rockwell-automation-logix-controllers-buffer-overflow-in-project  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-12011 · Severity: info · CVSS 9.2 · Published 2026-07-14

Rockwell Automation industrial controllers are susceptible to a denial-of-service vulnerability that can be triggered remotely. An attacker can send a specially crafted project file to the device, causing it to enter a 'major non-recoverable fault' state. This effectively shuts down the controller and halts the industrial processes it manages until manual intervention or hardware recovery is performed.

Vendors: [Rockwell Automation](https://junglewise.ai/threats/vendors/rockwell-automation).

## Quick answers

**Is CVE-2025-12011 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12011 being exploited in the wild.

**How severe is CVE-2025-12011?** Informational severity, with a CVSS score of 9.2, published 14 July 2026.

**Which products and versions are affected?** Rockwell Automation Compact GuardLogix 5370 V35.015 and earlier; Rockwell Automation CompactLogix 5370 V35.015 and earlier; Rockwell Automation ControlLogix 5570 V35.015 and earlier.

**Is there a fix for CVE-2025-12011?** A patch was published on 2026-07-14: Corrected firmware versions V35.016 and V36.011 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-12011 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2025-12011?** Check whether you run Rockwell Automation Compact GuardLogix 5370, Rockwell Automation CompactLogix 5370 or Rockwell Automation ControlLogix 5570 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A classic buffer overflow vulnerability (CWE-120) exists in the firmware of Rockwell Automation 5370 and 5570 series controllers. The flaw is triggered when the device processes an invalid project file loaded by a remote user. Successful exploitation causes the controller to enter a Major Non-Recoverable Fault (MNRF) state, resulting in a complete denial of service. The vulnerability is reachable over the network without authentication. Rockwell Automation has released firmware versions V35.016 and V36.011 to remediate this issue.

## Affected products

- Rockwell Automation CompactLogix 5370 V35.015 and earlier
- Rockwell Automation Compact GuardLogix 5370 V35.015 and earlier
- Rockwell Automation ControlLogix 5570 V35.015 and earlier
- Rockwell Automation GuardLogix 5570 V35.015 and earlier

## Timeline

- 2026-07-14: advisory: Initial advisory release by Rockwell Automation (SD1781)
- 2026-07-14: patched: Corrected firmware versions V35.016 and V36.011 released

## References

- [https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html](https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html)

## Related threats

- [Rockwell Automation Logix Controllers denial of service via CIP message](https://junglewise.ai/threats/cve-2026-11317-rockwell-automation-logix-controllers-denial-of-service-via-cip)