CVE-2025-13824: Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities
A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and reports fault code 0xF019. To recover, clear the fault.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rockwell Automation Micro820 controllersto a version that resolves this vulnerability.Fixed in L20E V23.011 - Upgrade
Upgrade
Rockwell Automation Micro850/870 controllersto a version that resolves this vulnerability.Fixed in L50E/L70E V23.012 - Operational
To recover after the controller enters a hard fault (solid red Fault LED), clear the fault. After a power cycle, the controller may enter a recoverable fault with MS LED and Fault LED flashing red and fault code 0xF019—proceed by clearing the fault.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13824?
CVE-2025-13824 is considered a high severity vulnerability due to its potential to cause a hard fault in affected controllers.
How do I fix CVE-2025-13824?
To mitigate CVE-2025-13824, you should ensure that your Rockwell Automation Micro820, Micro850, or Micro870 controllers are updated to the latest firmware version.
What devices are affected by CVE-2025-13824?
CVE-2025-13824 affects the Rockwell Automation Micro820, Micro850, and Micro870 controller models.
What happens to the controller when CVE-2025-13824 is triggered?
When CVE-2025-13824 is triggered, the controller enters a hard fault state and becomes unresponsive, indicated by a solid red Fault LED.
Is there a risk of permanent damage due to CVE-2025-13824?
While CVE-2025-13824 causes the controller to enter a fault state, it can be recovered after a power cycle, so there is no permanent damage expected.