CVE-2025-11694: Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities
A security issue exists within 1769 CompactLogix controllers due to the missing validation of sequence numbers and source IP addresses in the CIP protocol. This allows attacker to abuse the exposed Connection ID’s visible on the web interface to perform denial-of-service attacks, resulting in a minor fault.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rockwell Automation CompactLogix 5370 Controllersto a version that resolves this vulnerability.Fixed in V38.011 - Configuration
Disable the display of Connection IDs in the controller web interface, or disable the web interface entirely if it is not required.
Controller web interface expose Connection IDs = disable - Compensating control
Restrict access to the controller web interface to trusted management networks or IP addresses using firewall rules/ACLs, or isolate the device from untrusted networks to prevent abuse of exposed Connection IDs.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11694?
The severity of CVE-2025-11694 is classified as high with a CVSS score of 8.7.
What are the implications of CVE-2025-11694?
CVE-2025-11694 can lead to denial-of-service attacks by abusing the exposed Connection IDs in the web interface.
How can organizations mitigate CVE-2025-11694?
Organizations can mitigate CVE-2025-11694 by implementing proper validation of sequence numbers and IP addresses in their systems.
Which devices are affected by CVE-2025-11694?
The devices affected by CVE-2025-11694 include Rockwell Automation 1769 CompactLogix and CompactLogix 5370 controllers.
When was CVE-2025-11694 published?
CVE-2025-11694 was published on June 16, 2026.