This vulnerability (CVE-2025-12012) is a classic buffer overflow (CWE-120) in certain Rockwell Automation controllers (CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, GuardLogix 5570). It allows an unauthenticated attacker to send crafted invalid file data to the device, triggering a buffer copy without proper input size checking. This leads the device to enter a major non-recoverable fault state, effectively causing a denial-of-service condition. The CVSS 4.0 base score is 9.2, reflecting its critical severity and ease of exploitation without user interaction or privileges. No patch or remediation level is currently documented by the vendor.

Successful exploitation causes the affected controllers to enter a major non-recoverable fault (MNRF), resulting in denial of service. This disrupts normal operation of the industrial control systems relying on these devices. There is no indication of data confidentiality or integrity compromise beyond service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Rockwell Automation advisories for updates. No vendor-provided mitigation or workaround is currently documented.