1794-AENTR Adapter CVE-2026-0646

The attacker needs IP-level reachability to the 1794-AENTR's EtherNet/IP CIP service (typically TCP/44818 and UDP/2222) and the ability to send malformed or specifically crafted CIP protocol requests - no authentication, user interaction, or non-default configuration is required per CVSS PR:N/UI:N/AT:N. The realistic limiter is network exposure: 1794-AENTR adapters are deployed inside OT/ICS networks and should not be Internet-reachable in a properly segmented Purdue-model architecture, so exploitation in practice requires a foothold on a network with routed access to the control segment.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H confirms a remote, unauthenticated, low-complexity attack that produces high availability impact and no confidentiality or integrity impact - consistent with the DoS description. No EPSS score, KEV listing, or public POC was provided, so exploitation likelihood signals are absent. For an OT/ICS asset this is still a serious operational concern: faulting a FLEX I/O adapter drops process I/O until a physical reset, which in a running plant translates to unplanned downtime or safety-relevant loss of visibility. One inconsistency worth noting: the input tags include 'Information Disclosure,' which contradicts the CVSS (VC:N) and the description (pure DoS) - the tag appears to be mislabeled and should not drive prioritization.

An attacker with network reachability to the OT segment - for example via a compromised engineering workstation, exposed remote-access VPN, or flat IT/OT network - sends a sequence of crafted CIP requests to the 1794-AENTR's EtherNet/IP service. The adapter leaks memory until it faults, dropping all connected FLEX I/O modules and halting process visibility until an operator physically resets the device. No public exploit identified at time of analysis, but the protocol-level nature of the bug means a single-packet or short-sequence POC is plausible once details are reverse-engineered from the patch.