CVE-2025-7350: Critical RCE Flaw in Rockwell Stratix Switches Scores CVSS 9.6

CVE-2025-7350 is described as a critical remote code execution flaw in Rockwell Automation’s Stratix industrial Ethernet switches, with a CVSS score of 9.6. The vulnerability would allow unauthenticated remote attackers to execute code by exploiting CSRF weaknesses in Stratix IOS software. It affects Stratix IOS versions 15.2(8)E5 and earlier, including the product families 1783-BMS*, 1783-ZMS*, 1783-IMS*, 1783-HMS*, 1783-MS06T, and 1783-MS10T, with vulnerable deployments at risk unless updated.

Rockwell has released Stratix IOS version 15.2(8)E6 as the patched software, and customers are urged to upgrade immediately. According to Rockwell, a security issue affecting multiple Cisco devices also directly impacts Stratix 5410, 5700, and 8000 devices, enabling remote code execution by uploading and running malicious configurations without authentication.

The article also highlights recommended security practices, such as limiting network exposure, applying access control lists, and ensuring only trusted users and systems can reach management interfaces.