Loading story…
A critical vulnerability (CVE-2025-7350) has been identified in Rockwell Automation Stratix 5410, 5700, and 8000 industrial Ethernet switches, allowing unauthenticated remote code execution. The flaw, stemming from improper neutralization of special elements (CWE-74), enables attackers to upload and execute malicious configurations through cross-site request forgery. Rockwell Automation has released patches and recommends immediate updates and security best practices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rockwell Automation has disclosed a critical stack-based buffer overflow vulnerability affecting several of its products that utilize Cisco IOS XE Software. The vulnerability resides in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS XE, which is integrated into Rockwell Automation's Stratix series switches and various Lifecycle Services offerings. Specifically, the affected Stratix models include the 5700, 5400, 5410, 5200, and 5800, with vulnerable firmware versions identified as v15.2(8)E7 and prior for the 5700, 5400, and 5410, and v17.17.01 and prior for the 5200 and 5800. Additionally, Rockwell Automation's Industrial Data Center (IDC) with Cisco Switching (Generations 1-5), IDC-Managed Support contracts, Network-Managed Support contracts, and Firewall-Managed Support contracts with Cisco hardware are also impacted. The vulnerability can be exploited remotely with low attack complexity, requiring only SNMPv2c or earlier read-only community string or valid SNMPv3 user credentials for a denial-of-service (DoS) attack. For arbitrary code execution as the root user, an attacker would need SNMPv1 or v2c read-only community string or valid SNMPv3 user credentials with administrative or privilege 15 access. Exploitation is possible by sending crafted SNMP packets over IPv4 or IPv6 networks to the affected devices. Successful exploitation could allow an attacker to execute arbitrary code or cause a DoS condition, posing significant risks to industrial control systems and critical infrastructure environments where these devices are deployed. The vulnerability is rated with a CVSS v4 base score of 6.3, indicating a medium to high severity. Rockwell Automation has advised customers to review their SNMP configurations, restrict network access to trusted sources, and apply available patches or mitigations as soon as possible. The vulnerability is considered particularly concerning due to the widespread use of Cisco IOS XE in industrial environments and the potential for attackers to gain elevated privileges. Both advisories emphasize the importance of following best practices for network segmentation and access control to limit exposure. Organizations are urged to monitor for unusual SNMP activity and to ensure that only necessary SNMP services are enabled. The advisories also recommend disabling unused SNMP versions and enforcing strong authentication for SNMPv3. This vulnerability highlights the risks associated with third-party software components in industrial automation products and underscores the need for timely patch management and robust network defenses. The disclosure was coordinated with CISA, which has published advisories to inform and assist asset owners in mitigating the threat. No reports of active exploitation have been confirmed at the time of disclosure, but the technical details suggest that exploitation would be feasible for attackers with appropriate credentials. The affected products are widely deployed in critical infrastructure sectors, making prompt remediation essential to prevent potential operational disruptions or compromise.
Jun 29, 2026A high-severity denial-of-service vulnerability (CVE-2025-9166) affects Rockwell Automation ControlLogix 5580 controllers running firmware version 35.013. The flaw, caused by repeated message forwarding, can result in a major nonrecoverable fault, disrupting controller operations. Remediation is available via firmware update to version 35.014 or later, and immediate patching is advised.
Jun 29, 2026
A high-severity denial-of-service (DoS) vulnerability, tracked as CVE-2025-9124, has been identified in Rockwell Automation's Compact GuardLogix 5370 programmable logic controllers (PLCs). The vulnerability arises when the device receives a specifically crafted CIP (Common Industrial Protocol) unconnected explicit message, which can trigger a major non-recoverable fault in the controller. This fault condition can render the affected PLC inoperable until it is manually reset or serviced, potentially disrupting industrial automation processes that rely on these controllers for safety and operational continuity. The vulnerability is remotely exploitable, meaning an attacker does not require physical access to the device to trigger the fault. Rockwell Automation has acknowledged the issue and published a security advisory (SD1755) to inform customers and provide guidance. The advisory confirms that the vulnerability has been corrected in updated product versions, though no workaround is available for unpatched systems. There is currently no evidence that this vulnerability has been exploited in the wild, and it is not listed as a Known Exploited Vulnerability (KEV) by Rockwell Automation. The company emphasizes the importance of applying the corrective updates to mitigate the risk. The vulnerability has been assigned a CVSS 4.0 base score of 8.7, indicating a high level of risk due to the potential for significant operational impact. The affected product line, Compact GuardLogix 5370, is widely used in industrial environments for safety-critical automation tasks. Details about the specific affected versions have not been disclosed in the public advisories, but customers are urged to consult Rockwell Automation's official channels for the most current information. The vulnerability was disclosed and remediated on October 14, 2025, with both the CVE and the vendor advisory published on the same day. Rockwell Automation's Product Security Incident Response Team (PSIRT) is credited as the source of the vulnerability report. Customers are advised to review their deployment of Compact GuardLogix 5370 controllers and apply the recommended updates as soon as possible to prevent potential service interruptions. The absence of a workaround underscores the urgency of patching, as operational continuity could be at risk if the vulnerability is exploited. Organizations should also review their network segmentation and access controls to limit exposure of industrial control systems to untrusted networks.
Jun 29, 2026