CVE-2025-7353: Rockwell Automation ControlLogix® Ethernet Remote Code Execution Vulnerability

Severity: critical (CVSS 9.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-14 · updated 2026-06-17
Weakness: CWE-1188

Description

A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to connect to the WDB agent, it can allow remote attackers to perform memory dumps, modify memory, and control execution flow.

Affected products

Rockwell Automation 1756-EN2F/C: through Version 11.004
Rockwell Automation 1756-EN2T/D: through Version 11.004
Rockwell Automation 1756-EN2TP/A: through Version 11.004
Rockwell Automation 1756-EN2TR/C: through Version 11.004
Rockwell Automation 1756-EN3TR/B: through Version 11.004

References

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1732.html

Get alerted when CVE-2025-7353 or the next vulnerability affects your stack