Is CVE-2025-12012 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-12012 being exploited in the wild.

How severe is CVE-2025-12012?

Informational severity, with a CVSS score of 9.2, published 14 July 2026.

Which products and versions are affected?

Rockwell Automation Compact GuardLogix 5380 V34.012 and earlier, V35.011 and earlier; Rockwell Automation CompactLogix 5380 V34.012 and earlier, V35.011 and earlier; Rockwell Automation CompactLogix 5480 V34.012 and earlier, V35.011 and earlier; Rockwell Automation ControlLogix 5580 V34.012 and earlier, V35.011 and earlier; and 1 more.

Is there a fix for CVE-2025-12012?

A patch was published on 2026-07-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-12012 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-12012?

Check whether you run Rockwell Automation Compact GuardLogix 5380, Rockwell Automation CompactLogix 5380, Rockwell Automation CompactLogix 5480 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-12012: Rockwell Automation Logix Controllers buffer overflow in file handling

CVE-2025-12012 · Severity: info · CVSS 9.2 · Published 2026-07-14

Rockwell Automation Logix controllers, which are used to manage industrial processes and machinery, are vulnerable to a denial-of-service attack. An attacker can send malicious file data to the controller, causing it to crash and enter a non-recoverable fault state. This would result in an immediate shutdown of the industrial equipment being controlled, potentially disrupting production or safety operations.

Technologies: Rockwell Automation CompactLogix 5380, Rockwell Automation ControlLogix 5580, Rockwell Automation GuardLogix 5580. Vendors: Rockwell Automation.

Quick answers

Is CVE-2025-12012 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-12012 being exploited in the wild.
How severe is CVE-2025-12012?: Informational severity, with a CVSS score of 9.2, published 14 July 2026.
Which products and versions are affected?: Rockwell Automation Compact GuardLogix 5380 V34.012 and earlier, V35.011 and earlier; Rockwell Automation CompactLogix 5380 V34.012 and earlier, V35.011 and earlier; Rockwell Automation CompactLogix 5480 V34.012 and earlier, V35.011 and earlier; Rockwell Automation ControlLogix 5580 V34.012 and earlier, V35.011 and earlier; and 1 more.
Is there a fix for CVE-2025-12012?: A patch was published on 2026-07-14. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-12012 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-12012?: Check whether you run Rockwell Automation Compact GuardLogix 5380, Rockwell Automation CompactLogix 5380, Rockwell Automation CompactLogix 5480 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A classic buffer overflow (CWE-120) exists in the firmware of Rockwell Automation 5380, 5480, and 5580 series controllers. The vulnerability is triggered when a malicious user writes invalid file data to the controller, likely via network-accessible services. Successful exploitation causes the device to enter a Major Non-Recoverable Fault (MNRF), effectively a permanent denial-of-service state until manual intervention or recovery procedures are performed. The issue is addressed in firmware versions V34.014, V35.013, and V36.011 or later.

Affected products

Rockwell Automation CompactLogix 5380 V34.012 and earlier, V35.011 and earlier
Rockwell Automation Compact GuardLogix 5380 V34.012 and earlier, V35.011 and earlier
Rockwell Automation CompactLogix 5480 V34.012 and earlier, V35.011 and earlier
Rockwell Automation ControlLogix 5580 V34.012 and earlier, V35.011 and earlier
Rockwell Automation GuardLogix 5580 V34.012 and earlier, V35.011 and earlier

Timeline

2026-07-14: advisory
2026-07-14: patched

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1781.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.