CVE-2025-9282
Published: 20 January 2026
Summary
CVE-2025-9282 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Rockwellautomation Armorstart Lt Firmware. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Deeper analysis
CVE-2025-9282 is a denial-of-service vulnerability affecting ArmorStart® LT devices from Rockwell Automation. The issue manifests during execution of Achilles Comprehensive limited storm tests, where the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds. It is classified under CWE-400 (Uncontrolled Resource Consumption) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.
The vulnerability is exploitable remotely over the network by unauthenticated attackers with low complexity and no user interaction required. Successful exploitation triggers an unexpected reboot of the ArmorStart® LT device, disrupting the Link State Monitor and leading to a temporary denial-of-service condition, while confidentiality and integrity remain unaffected.
Mitigation details are provided in the Rockwell Automation security advisory available at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1768.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3424
Vulnerability details
A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive limited storm tests, the device reboots unexpectedly, causing the Link State Monitor to go down for several seconds.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated network exploitation of resource exhaustion leading to device reboot/DoS directly maps to public-facing app exploitation and application/system exploitation for endpoint DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly implements protections against denial-of-service attacks, including network floods like the Achilles storm tests that cause unexpected reboots in ArmorStart LT devices.
Ensures resource availability by monitoring and controlling resource consumption, mitigating the uncontrolled resource exhaustion (CWE-400) that triggers device reboots.
Provides for timely flaw remediation, such as applying Rockwell Automation patches, to eliminate the specific vulnerability exploited by network storm tests.