1715 EtherNet/IP Adapter CVE-2025-9178
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach adapter on OT network
-
DeliverySend crafted CIP payload
-
ExploitTrigger out-of-bounds write/memory corruption
-
ExecutionHalt all CIP communication
-
ImpactDevice offline until manual restart
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special configuration is required: exploitation needs only network-level reachability to a 1715 EtherNet/IP Adapter that accepts CIP communication, which is the device's normal operating mode (AV:N/AC:L/PR:N/UI:N - remote, unauthenticated, no user interaction). The practical limiting factor is network exposure: these adapters typically reside on segmented OT/control networks, so an attacker must already be able to route CIP traffic to the device. Impact is confined to availability - communication stops and a manual restart is required to recover - with no stated confidentiality or integrity effect. |
| Impact | This is a genuine but bounded operational risk rather than a critical priority. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation, and the vendor-authored vector scores impact solely as subsequent-system availability (SA:H) with no confidentiality, integrity, or primary-system availability impact - consistent with a pure denial-of-service that halts CIP communication on the 1715 EtherNet/IP Adapter until a manual restart. EPSS is low (0.32%, 23rd percentile), there is no CISA KEV listing and no public exploit identified, which collectively argue against imminent widespread exploitation. The tension worth noting: CWE-787 (out-of-bounds write) plus the 'Buffer Overflow / Memory Corruption' tags describe a memory-safety defect that could in principle permit more than DoS, yet the vendor explicitly scopes the outcome to loss of communication with no code-execution or integrity impact - treat the DoS-only characterization as the confirmed effect and any RCE speculation as unverified. In OT/ICS environments, loss of a safety/IO adapter requiring a physical restart can carry disproportionate process-availability consequences despite the modest score. |
| Exploit ScenarioDerived | An attacker with network reachability to the industrial network sends crafted CIP (Common Industrial Protocol) messages to a 1715 EtherNet/IP Adapter, triggering an out-of-bounds write that corrupts memory and stops the device from processing further CIP communication. The adapter becomes unresponsive and must be manually restarted to restore service, disrupting the attached I/O or control process. No public exploit code is known, but the low attack complexity and lack of authentication make exploitation straightforward for anyone who can reach the device on the network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Crafted CIP payloads can cause a denial-of-service condition in the 1715 EtherNet/IP Adapter, resulting in loss of CIP communication that requires a manual restart to recover. The vulnerability is an out-of-bounds write (CWE-787) allowing remote, unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N) to disrupt availability; no special configuration is needed beyond network reachability to the device. No public exploit or active exploitation has been identified, and EPSS is low at 0.32%. The vendor CVSS 4.0 score is 7.7, but practical risk is bounded by the need for network access to the OT device.
RemediationAI
No vendor-released patch was identified from the provided data; consult Rockwell Automation advisory SD1757 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1757.html) for patch availability and version-specific fixes. As a compensating control, restrict network access to the 1715 EtherNet/IP Adapter using OT firewalls or ACLs to allow only trusted CIP clients on the necessary ports (e.g., TCP/UDP 44818). This may disrupt legitimate control traffic if not carefully scoped. Additionally, place the adapter on a segmented network to reduce exposure, and monitor for anomalous CIP packets that could indicate exploitation attempts. Be prepared to manually restart the device to recover from a successful DoS.
Affected ProductsAI
The vulnerability affects the Rockwell Automation 1715 EtherNet/IP Adapter. Specific firmware version ranges are not detailed in the provided data; refer to Rockwell Automation security advisory SD1757 for a complete list of affected versions and updates. No CPE strings are provided. The device is used for industrial control applications and communicates via CIP over EtherNet/IP.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The 1715 EtherNet/IP Adapter uses the Common Industrial Protocol (CIP) over EtherNet/IP for industrial control communications. The vulnerability is an out-of-bounds write (CWE-787) that occurs when processing crafted CIP packets, leading to memory corruption and a denial-of-service condition. The CVSS 4.0 vector indicates scope change (SA:H) but the assessed impact is limited to availability; confidentiality and integrity are not affected. The device typically resides on segmented OT networks, so exploitation requires an attacker to have network reachability to the adapter on its CIP communication port, likely TCP/UDP 44818. No CPE data was provided; consult the vendor advisory for specific affected firmware versions.
Know when Rockwell Automation gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H
Remote unauthenticated crafted CIP packets (AV:N/AC:L/PR:N/UI:N) crash the adapter affecting the attached control process, so scope change (S:C) with availability-only impact (A:H).
Primary rating from Vendor (rockwellautomation).
CVSS VectorVendor: rockwellautomation
DescriptionCVE.org
A denial-of-service security issue exists in the affected product and version. The security issue is caused through CIP communication using crafted payloads. The security issue could result in no CIP communication with 1715 EtherNet/IP Adapter.A restart is required to recover.
Executive ViewAI
A high-severity, unauthenticated denial-of-service flaw in the 1715 EtherNet/IP Adapter can halt CIP communications and force a manual restart, disrupting industrial processes that rely on the affected adapter. Leadership should prioritize network segmentation, access control, and monitoring because exploitation requires network reachability to the OT device. No public exploit identified at time of analysis; no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis; interim mitigations include segmenting the 1715 EtherNet/IP Adapter behind strict firewall/ACL rules, allowing only trusted controllers and engineering workstations to reach its CIP/EtherNet-IP interfaces, monitoring for anomalous CIP payloads, restricting remote access, and maintaining a documented manual restart procedure until a vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
More in Rockwell Automation
View allAuthentication bypass in Rockwell Automation FactoryTalk Historian Site Edition allows remote attackers to obtain a vali
Denial-of-service in Rockwell Automation CompactLogix/GuardLogix 5380, CompactLogix 5480, and ControlLogix/GuardLogix 55
Denial-of-service in Rockwell Automation Logix programmable controllers allows a remote unauthenticated attacker to writ
Remote denial-of-service in Rockwell Automation CompactLogix 5370, Compact GuardLogix 5370, ControlLogix 5570, and Guard
Denial-of-service in Rockwell Automation 1769 CompactLogix 5370 controllers allows remote unauthenticated attackers to i
Authorization bypass in Rockwell Automation FactoryTalk Analytics PavilionX allows unauthenticated remote attackers to i
Unauthenticated attackers who can reach the management or critical-function interfaces of a Rockwell Automation 1783-NAT
Local authenticated code execution in Rockwell Automation Studio 5000 Logix Designer allows any low-privileged authentic
Local arbitrary code execution in Rockwell Automation Studio 5000 Logix Designer arises because the External Tools confi
Remote denial-of-service in Rockwell Automation RSLinx Classic allows an unauthenticated network attacker to crash the R
Weak bcrypt work factor in Rockwell Automation OTTO Fleet Manager exposes stored password hashes to accelerated offline
Unauthenticated modification of the embedded webserver password on Rockwell Automation 1732E ArmorBlock I/O modules allo
GitHub PoC
Exploit-DB