Denial-of-Service Vulnerability in Rockwell Automation's CompactLogix Controllers
CVE-2025-11694

8.7HIGH

Key Information:

Vendor

Rockwell Automation
Status
Compactlogix 5370
Vendor
CVE Published:
16 June 2026

What is CVE-2025-11694?

A security flaw found in Rockwell Automation's 1769 CompactLogix controllers arises from the lack of validation for sequence numbers and source IP addresses within the CIP protocol. This vulnerability can be exploited by attackers to utilize exposed Connection IDs visible on the web interface, potentially leading to denial-of-service attacks that may cause minor faults in the affected devices.

Affected Version(s)

CompactLogix 5370 V36

References

https://www.rockwellautomation.com/en-us/trust-center/sec...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.