CVE-2025-13824

HighCVSS 8.7/10Last modified Oct 7, 2026

Description

A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becomes unresponsive. Upon power cycle, the controller will enter recoverable fault where the MS LED and Fault LED become flashing red and reports fault code 0xF019. To recover, clear the fault.

Metrics

CVSS 4.0 8.7/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-763

Affected software

No affected versions have been published.

Timeline

Published
Dec 15, 2025
Last modified
Oct 7, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-138268.2Zervit's portable HTTP/web server is vulnerable to remote DoS attacks when a configuration reset request is made. The vulnerability is causeCVE-2025-138278.8Summary Arbitrary files can be uploaded via the GrapesJS Builder, as the types of files that can be uploaded are not restricted. ImpactIf tCVE-2025-138289.0SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in updaCVE-2025-138298.6Incorrect Authorization vulnerability in Data Illusion Zumbrunn NGSurvey allows any logged-in user to obtain the private information of any CVE-2025-13834.3The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. CVE-2025-138356.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arcoCVE-2025-138367.5When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allowsCVE-2025-138375.5When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DCVE-2025-138386.4The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' shCVE-2025-138396.4The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' shortcode in all versCVE-2025-13847.0Least Privilege Violation (CWE-272) Vulnerability exists in the communication function between the NJ/NX-series Machine Automation ControlleCVE-2025-138406.4The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_sear