Critical severity · published Jul 14, 2026
CVE-2025-11698
CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow
9.2
CVSS
0.4%
EPSS
No
On KEV
Description
A denial-of-service issue exists in 5380/5480/5580 controllers boot firmware lower than version 1.072. This vulnerability could potentially allow a malicious user to write invalid file data to the controller, causing the device to enter a major non-recoverable fault (MNRF).
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C5
CompactLogix® 5380 Recovery Image Compact GuardLogix® 5380 Recovery Image CompactLogix® 5480 Recovery Image ControlLogix® 5580 Recovery Image GuardLogix® 5580 Recovery Image · Rockwell Automation
Boot firmware versions before 1.072 · source: vendor
In the news
VulnerabilityHigh
Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix
View CSAF
Summary
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.
The following versions of Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix are affected:
CompactLogix 5370 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
Compact GuardLogix 5370 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
ControlLogix 5570 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
GuardLogix 5570 <=V35.015 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5380 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5380 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
Compact GuardLogix 5380 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
Compact GuardLogix 5380 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5480 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5480 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
ControlLogix 5580 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
ControlLogix 5580 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
GuardLogix 5580 <=V34.012 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
GuardLogix 5580 <=V35.011 (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698)
CompactLogix 5380 Recovery Image <=1.072 (CVE-2025-12011, CVE-2025-120...
Jul 16, 2026·CISA Advisories
Affected product
C5
CompactLogix® 5380 Recovery Image Compact GuardLogix® 5380 Recovery Image CompactLogix® 5480 Recovery Image ControlLogix® 5580 Recovery Image GuardLogix® 5580 Recovery Image
Rockwell Automation