Loading vulnerability…
Denial of Service in Rockwell Automation 5380/5480/5580 Controller Boot Firmware
CVE-2025-11698 is a denial-of-service vulnerability affecting Rockwell Automation 5380, 5480, and 5580 controller recovery image boot firmware versions earlier than 1.072, including CompactLogix 5380, Compact GuardLogix 5380, CompactLogix 5480, ControlLogix 5580, and GuardLogix 5580 recovery images. The flaw allows a malicious user to write invalid file data to the controller. Processing this malformed data can cause the device to enter a major non-recoverable fault (MNRF), rendering the controller unavailable and requiring recovery actions. Specific vulnerable routines are not identified in the available information.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes the affected controller to enter a major non-recoverable fault, resulting in denial of service and loss of controller availability. The available scoring information indicates high availability impact on the vulnerable system, with no stated confidentiality or integrity impact.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, reduce exposure to untrusted users and untrusted file inputs that could be written to controller recovery image boot firmware workflows, and restrict network and operational access to affected controllers until the firmware can be updated. Specific vendor mitigation guidance beyond upgrading is not available in the provided information.
Patch, then assume compromise.
Upgrade affected 5380/5480/5580 controller boot firmware to version 1.072 or later.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.