CVE-2025-11698 is a classic buffer overflow vulnerability (CWE-120) in the boot firmware of Rockwell Automation CompactLogix 5380, Compact GuardLogix 5380, CompactLogix 5480, ControlLogix 5580, and GuardLogix 5580 controllers. The issue exists in firmware versions prior to 1.072 and allows an unauthenticated attacker to write invalid file data to the device. This can cause the controller to enter a major non-recoverable fault state, effectively causing a denial-of-service condition. The vulnerability has a CVSS 4.0 base score of 9.2, indicating critical severity. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

Successful exploitation results in a denial-of-service condition where the affected controller enters a major non-recoverable fault (MNRF) state, disrupting normal operation. This can impact industrial control systems relying on these controllers, potentially causing operational downtime.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected controllers and validate any input data to the device where possible to prevent injection of invalid file data. Monitor vendor communications for updates on patches or mitigations.