cve 2025 11697

CVE-2025-11697 is a high-severity vulnerability in Rockwell Automation's Studio 5000 Simulation Interface, disclosed alongside CVE-2025-11696. This flaw involves a local server-side request forgery (SSRF) that can force outbound SMB connections to harvest NTLM hashes, posing a significant risk to industrial control system (ICS) and operational technology (OT) environments. Rockwell has released a corrective update and mitigation guidance. The vulnerability underscores the need to treat engineering workstations and simulator services as privileged infrastructure, especially when reachable from business networks. Community analysts have identified realistic weaponization paths for environments with exposed simulation services.