Vulnerabilities ›

CVE-2025-9279

High

A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limit Storm tests, the device reboots unexpectedly, ca

CWE-400 — Weakness Type

                    Published: Jan 20, 2026                      ·  Modified: Feb 28, 2026                      ·  Source: NVD                

CVSS v3

7.5

🔗 NVD Official

📄 Description (English)

🤖 AI Executive Summary

CVE-2025-9279 is a denial-of-service vulnerability in Rockwell Automation's ArmorStart LT firmware that causes unexpected device reboots during EtherNet/IP stress testing, resulting in Link State Monitor downtime. With a CVSS score of 7.5 and no exploit currently available, this vulnerability poses a significant risk to industrial control systems in Saudi Arabia's critical infrastructure. Immediate patching is recommended for all affected deployments, particularly in energy and manufacturing sectors.

📄 Description (Arabic)

🤖 AI Intelligence Analysis Analyzed: May 2, 2026 23:36

🇸🇦 Saudi Arabia Impact Assessment

This vulnerability directly impacts Saudi Arabia's critical infrastructure, particularly: (1) Energy Sector - ARAMCO and downstream petroleum operations relying on Rockwell Automation ICS/SCADA systems for pipeline monitoring and refinery control; (2) Water & Electricity - SEC and regional utilities using ArmorStart LT for network protection in water treatment and power distribution; (3) Manufacturing - Saudi industrial facilities dependent on EtherNet/IP-based automation; (4) Petrochemical Facilities - SABIC and affiliated plants using industrial networking equipment. The DoS condition could disrupt operational technology networks, causing production halts, safety system failures, and potential environmental incidents. Organizations in NEOM and other mega-projects utilizing modern ICS infrastructure are particularly vulnerable.

🏢 Affected Saudi Sectors

Energy & Petroleum (ARAMCO, downstream operations) Water & Electricity (SEC, regional utilities) Manufacturing & Industrial Petrochemical (SABIC) Critical Infrastructure Smart City Projects (NEOM)

🎯 MITRE ATT&CK Techniques

T1499 - Endpoint Denial of Service T1561 - Disk Wipe T1529 - System Shutdown/Reboot T1657 - Financial Theft

⚖️ Saudi Risk Score (AI)

7.8

/ 10.0

🔧 Remediation Steps (English)

Immediate Actions:

1. Identify all ArmorStart LT devices in your environment using network discovery tools and asset management systems

2. Document current firmware versions and create an inventory of affected systems

3. Assess operational criticality and schedule maintenance windows with minimal production impact

4. Implement network segmentation to isolate ArmorStart LT devices from untrusted networks

5. Enable enhanced monitoring on EtherNet/IP traffic for anomalous patterns

Patching Guidance:

1. Contact Rockwell Automation for the latest firmware patch addressing CVE-2025-9279

2. Test patches in a non-production environment first, particularly for SCADA/ICS systems

3. Follow Rockwell Automation's change management procedures for firmware updates

4. Coordinate with operations teams to schedule updates during planned maintenance windows

5. Verify Link State Monitor functionality post-patch

Compensating Controls (if patching delayed):

1. Implement rate limiting on EtherNet/IP connections to prevent stress conditions

2. Deploy network-based IDS/IPS rules to detect abnormal EtherNet/IP traffic patterns

3. Configure device monitoring to alert on unexpected reboots

4. Maintain redundant network paths to ensure service continuity

5. Implement strict access controls limiting EtherNet/IP device access to authorized personnel only

Detection Rules:

1. Monitor for unexpected ArmorStart LT device reboots using syslog analysis

2. Alert on Link State Monitor status changes or connectivity losses

3. Track EtherNet/IP traffic volume spikes that could trigger stress conditions

4. Implement SNMP monitoring for device uptime and restart events

5. Create correlation rules linking multiple device reboots to potential coordinated attacks

🔧 خطوات المعالجة (العربية)

الإجراءات الفورية:

1. تحديد جميع أجهزة ArmorStart LT في بيئتك باستخدام أدوات اكتشاف الشبكة وأنظمة إدارة الأصول

2. توثيق إصدارات البرنامج الثابت الحالية وإنشاء جرد للأنظمة المتأثرة

3. تقييم الأهمية التشغيلية وجدولة نوافذ الصيانة بأقل تأثير على الإنتاج

4. تنفيذ تقسيم الشبكة لعزل أجهزة ArmorStart LT عن الشبكات غير الموثوقة

5. تفعيل المراقبة المحسّنة على حركة EtherNet/IP للكشف عن الأنماط الشاذة

إرشادات التصحيح:

1. التواصل مع Rockwell Automation للحصول على أحدث تصحيح برنامج ثابت يعالج CVE-2025-9279

2. اختبار التصحيحات في بيئة غير إنتاجية أولاً، خاصة لأنظمة SCADA/ICS

3. اتباع إجراءات إدارة التغيير من Rockwell Automation لتحديثات البرنامج الثابت

4. التنسيق مع فرق العمليات لجدولة التحديثات خلال نوافذ الصيانة المخطط لها

5. التحقق من وظائف Link State Monitor بعد التصحيح

الضوابط البديلة (إذا تأخر التصحيح):

1. تنفيذ تحديد معدل على اتصالات EtherNet/IP لمنع ظروف الضغط

2. نشر قواعد IDS/IPS المستندة إلى الشبكة للكشف عن أنماط حركة EtherNet/IP غير الطبيعية

3. تكوين مراقبة الجهاز للتنبيه عند إعادة التشغيل غير المتوقعة

4. الحفاظ على مسارات شبكة زائدة لضمان استمرارية الخدمة

5. تنفيذ ضوابط وصول صارمة تقصر الوصول إلى جهاز EtherNet/IP على الموظفين المصرح لهم فقط

قواعد الكشف:

1. مراقبة إعادة تشغيل جهاز ArmorStart LT غير المتوقعة باستخدام تحليل syslog

2. التنبيه عند تغييرات حالة Link State Monitor أو فقدان الاتصال

3. تتبع ارتفاعات حجم حركة EtherNet/IP التي قد تؤدي إلى ظروف الضغط

4. تنفيذ مراقبة SNMP لوقت التشغيل والأحداث المتعلقة بإعادة التشغيل

5. إنشاء قواعد الارتباط التي تربط إعادة تشغيل أجهزة متعددة بالهجمات المنسقة المحتملة

📋 Regulatory Compliance Mapping

🟢 NCA ECC 2024

ECC 2024 - 5.1.1: Asset Management and Inventory Control ECC 2024 - 5.2.1: Vulnerability Management ECC 2024 - 5.3.1: Patch Management ECC 2024 - 6.1.1: Network Segmentation ECC 2024 - 7.1.1: Monitoring and Logging

🔵 SAMA CSF

SAMA CSF - Identify: Asset Management (ID.AM-1, ID.AM-2) SAMA CSF - Protect: Access Control (PR.AC-1, PR.AC-3) SAMA CSF - Protect: Maintenance (PR.MA-2) SAMA CSF - Detect: Anomalies and Events (DE.AE-1, DE.AE-2) SAMA CSF - Respond: Response Planning (RS.RP-1)

🟡 ISO 27001:2022

ISO 27001:2022 - A.5.19: Management of Information Security Incidents ISO 27001:2022 - A.8.1: User Endpoint Devices ISO 27001:2022 - A.8.6: Management of Technical Vulnerabilities ISO 27001:2022 - A.12.6: Management of Technical Vulnerabilities ISO 27001:2022 - A.14.2: Information Security Requirements Analysis and Specification

🔗 References & Sources 1

🔗

https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD17...

PSIRT@rockwellautomation.com

Vendor Advisory

📦 Affected Products / CPE 1 entries

rockwellautomation:armorstart_lt_firmware

📊 CVSS Score

7.5

/ 10.0 — High

📊 CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorN — None / Network

Attack ComplexityL — Low / Local

Privileges RequiredN — None / Network

User InteractionN — None / Network

ScopeU — Unchanged

ConfidentialityN — None / Network

IntegrityN — None / Network

AvailabilityH — High

📋 Quick Facts

Severity High

CVSS Score7.5

CWECWE-400

EPSS0.11%

Exploit No

Patch ✓ Yes

Published 2026-01-20

Source Feed nvd

🇸🇦 Saudi Risk Score

7.8

/ 10.0 — Saudi Risk

Priority: HIGH

🏷️ Tags

CWE-400

🏢 Vendor Advisories

🔗 https://www.rockwellautomation.com/en-us/trust-cente...

⚡ Actions

🔗 NVD Official Page ⚡ Exploit-DB Search 🐙 GitHub PoC Search 🎯 MITRE ATT&CK 📊 CVE Details

💬 Comments

Loading comments

CVE-2025-9279

💬 Comments

Introduce Yourself

Sign In Required