CVE-2025-13824: rockwell automation micro820®, micro850®, micro870® Release of Invalid Pointer or Reference

Vulnerability summary

CVE-2025-13824 is a high (CVSS 8.7) Release of Invalid Pointer or Reference vulnerability in rockwell automation micro820®, micro850®, micro870®. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.3% of scored vulnerabilities.

Timeline

1. 15-12-2025
   PublishedVulnerability first disclosed.
2. 15-12-2025
   Last modifiedVulnerability information updated.

Description

A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and reports fault code 0xF019. To recover, clear the fault.

• CWE-763Release of Invalid Pointer or ReferenceThe product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.