CVE-2025-14027
Unknown Unknown - Not Provided
Denial-of-Service in Rockwell Automation Devices Causes System Hang

Publication date: 2026-01-20

Last updated on: 2026-01-20

Assigner: Rockwell Automation

Description
Multiple denial-of-service vulnerabilities exist in the affected product. These issues can be triggered through various crafted inputs, including malformed Class 3 messages, memory leak conditions, and other resource exhaustion scenarios. Exploitation may cause the device to become unresponsive and, in some cases, result in a major nonrecoverable fault. Recovery may require a restart.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-20
Last Modified
2026-01-20
Generated
2026-06-16
AI Q&A
2026-01-20
EPSS Evaluated
2026-06-15
NVD
CVE-2025-14027
EUVD
EUVD-2026-3439
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
rockwell_automation 1756-rm2 *
rockwell_automation 1756-rm3 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves multiple denial-of-service (DoS) issues in the 1756-RM2 ControlLogix Redundancy Module. It can be triggered by specially crafted inputs such as malformed Class 3 messages, memory leaks, and other resource exhaustion scenarios. Exploiting these issues can cause the device to become unresponsive or suffer a major nonrecoverable fault, potentially requiring a restart to recover. [1]

Impact Analysis

Exploitation of this vulnerability can cause the affected device to become unresponsive or experience a major nonrecoverable fault. This can disrupt critical industrial operations relying on the 1756-RM2 ControlLogix Redundancy Module, potentially leading to downtime and requiring a device restart to recover. [1]

Detection Guidance

The provided resources do not include specific detection methods or commands to identify this vulnerability on your network or system.

Mitigation Strategies

Immediate mitigation steps include following Rockwell Automation's security best practices as a workaround and considering upgrading to the newer 1756-RM3 module, as no firmware correction is currently available for the affected 1756-RM2 module. Additionally, subscribing to security alerts and contacting Rockwell Automation TechConnect for support is recommended. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-14027. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart