industrial-control-system-vulnerabilitycritical-infrastructure-threat

CISA ICS Advisories Flag High-Severity DoS Flaws in Rockwell Automation ArmorStart LT and ControlLogix

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jan 30, 2026

CISA published ICS advisories warning that multiple Rockwell Automation products contain remotely triggerable vulnerabilities that can cause denial-of-service (DoS) conditions. In ArmorStart LT (models 290D/291D/294D running <= v2.002), CISA lists multiple CVEs (including CVE-2025-9464/9465/9466 and CVE-2025-9278 through CVE-2025-9283) tied to uncontrolled resource consumption (CWE-400). The issue can be triggered during fuzzing of multiple CIP classes, causing the device’s CIP port to become unresponsive; CISA rates the condition CVSS 7.5 (HIGH).

A separate CISA advisory covers ControlLogix 1756-RM2 and 1756-RM2XT Redundancy Enhanced Modules (firmware all versions) impacted by CVE-2025-14027, described as resource-exhaustion and memory-management problems (CWE-401) that can be triggered via crafted inputs such as malformed Class 3 messages. Exploitation may render devices unresponsive and can lead to a major nonrecoverable fault requiring a restart; CISA also rates this CVSS 7.5 (HIGH) and notes broad deployment across multiple critical infrastructure sectors. A separate report about a Johnson Controls Metasys SQL injection vulnerability (CVE-2025-26385, CVSS 10) is a different vendor/product and is not part of the Rockwell advisories described above.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

4 events · Jan 29, 2026

Jan 29, 20269mo ago
CISA republishes Rockwell ControlLogix advisory
CISA published ICS advisory ICSA-26-029-03 as an initial republication of Rockwell Automation advisory SD1769 covering CVE-2025-14027 in ControlLogix Redundancy Enhanced Modules. The agency recommended standard ICS mitigations and said it had not received reports of public exploitation.
Jan 29, 20269mo ago
CISA republishes Rockwell ArmorStart LT advisory
CISA published ICS advisory ICSA-26-029-02 as an initial republication of Rockwell Automation advisory SD1768, warning critical manufacturing operators about the ArmorStart LT vulnerabilities and recommending standard ICS network-hardening measures. CISA said it was not aware of public exploitation at the time of publication.
Jan 29, 20269mo ago
Rockwell discloses ControlLogix redundancy module DoS flaw
Rockwell Automation advisory SD1769 disclosed CVE-2025-14027, a high-severity denial-of-service vulnerability affecting all firmware versions of the 1756-RM2 and 1756-RM2XT ControlLogix Redundancy Enhanced Modules. Crafted inputs can exhaust resources and render the device unresponsive, potentially causing a major nonrecoverable fault that requires a restart.
Jan 29, 20269mo ago
Rockwell discloses ArmorStart LT denial-of-service vulnerabilities
Rockwell Automation advisory SD1768 described multiple high-severity denial-of-service flaws in ArmorStart LT 290D, 291D, and 294D devices up to version 2.002. The vulnerabilities can be triggered over the network and may cause CIP port unresponsiveness, device reboots, loss of ICMP connectivity, and temporary Link State Monitor outages.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

10 linked

Organizations

1 linked

Rockwell Automation

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Cisa AlertsAdvisories · Jan 29, 2026

Rockwell Automation ArmorStart LT | CISAOpen source ↗

Cisa AlertsAdvisories · Jan 29, 2026

Rockwell Automation ControlLogix | CISAOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

CISA ICS Advisories Flag High-Severity DoS Flaws in Rockwell Automation ArmorStart LT and ControlLogix

How this story unfolded

CISA republishes Rockwell ControlLogix advisory

CISA republishes Rockwell ArmorStart LT advisory

Rockwell discloses ControlLogix redundancy module DoS flaw

Rockwell discloses ArmorStart LT denial-of-service vulnerabilities

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Rockwell Automation ICS Products Hit by Authentication, Authorization, DoS, and RCE Flaws

Rockwell Automation Patches Critical and High-Severity Industrial-Control Flaws

CISA ICS Advisories Highlight Multiple High-Impact Vulnerabilities Across Industrial and IoT Products

CISA ICS Advisories Flag High-Severity DoS Flaws in Rockwell Automation ArmorStart LT and ControlLogix

How this story unfolded

CISA republishes Rockwell ControlLogix advisory

CISA republishes Rockwell ArmorStart LT advisory

Rockwell discloses ControlLogix redundancy module DoS flaw

Rockwell discloses ArmorStart LT denial-of-service vulnerabilities

Related entities

Vulnerabilities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Rockwell Automation ICS Products Hit by Authentication, Authorization, DoS, and RCE Flaws

Rockwell Automation Patches Critical and High-Severity Industrial-Control Flaws

CISA ICS Advisories Highlight Multiple High-Impact Vulnerabilities Across Industrial and IoT Products