PT-2025-33275 · Rockwell Automation · Controllogix Ethernet Modules

Published 2025-08-14 · Updated 2025-09-23 · CVE-2025-7353

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ControlLogix Ethernet Modules versions prior to 12.001

Description: A security issue exists in Rockwell Automation ControlLogix Ethernet Modules due to the web-based debugger agent. Connecting to the WDB agent using a specific IP address can allow remote attackers to perform memory dumps, modify memory, and control execution flow. Approximately 1.8K services are exposed yearly.

Recommendations: Update firmware to version 12.001. Alternatively, disable the WDB agent.

Fix

RCE

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-1188

Related Identifiers

BDU:2025-09996

CVE-2025-7353

Affected Products

Controllogix Ethernet Modules

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-7353 · Security Note
• https://bdu.fstec.ru/vul/2025-09996 · Security Note
• https://twitter.com/sctocs25/status/1957475482829468007 · Twitter Post
• https://twitter.com/windowsforum/status/1956032453916639648 · Twitter Post
• https://twitter.com/dailytechonx/status/1957585803460419801 · Twitter Post
• https://twitter.com/HunterMapping/status/1958103679002620117 · Twitter Post
• https://t.me/pentestingnews/66470 · Telegram Post
• https://twitter.com/rewterz/status/1957687137647649129 · Twitter Post
• https://twitter.com/rst_con/status/1958514422730924223 · Twitter Post
• https://twitter.com/Komodosec/status/1970307179816329363 · Twitter Post
• https://twitter.com/CVEnew/status/1956021910602404315 · Twitter Post
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1732.html · Note
• https://rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1733.html · Note
• https://twitter.com/fridaysecurity/status/1957236999582310906 · Twitter Post