EUVD-2026-43675
GHSA-79wc-xmfc-9mc6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable debug CLI (PR:N/AC:L/AV:N); control extends to the driven physical I/O beyond the device, so S:C with full C/I/A:H.
Primary rating from Vendor (rockwellautomation).
CVSS VectorVendor: rockwellautomation
Lifecycle Timeline
2DescriptionCVE.org
A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible debug port that does not enforce proper privilege controls, allowing unauthenticated remote access to intrusive command-line interface (CLI) commands. If exploited, a threat actor could read or delete files, stop tasks, modify memory, and change I/O states, potentially impacting the confidentiality, integrity, and availability of the device.
AnalysisAI
Unauthenticated remote command execution on Rockwell Automation's 1715-AENTR EtherNet/IP Adapter arises from a network-accessible debug port that enforces no privilege controls, exposing intrusive CLI commands to any attacker who can reach the device. An unauthenticated remote actor can read and delete files, halt tasks, modify memory, and manipulate physical I/O states, giving full control over device confidentiality, integrity, and availability. Rated CVSS 4.0 10.0 (Critical) with subsequent-system impact; no public exploit has been identified at time of analysis.
Technical ContextAI
The 1715-AENTR is the EtherNet/IP redundant adapter module that fronts Rockwell's 1715 Redundant I/O system, bridging an EtherNet/IP control network to distributed I/O in industrial/OT environments. The root cause is CWE-306 (Missing Authentication for a Critical Function): a diagnostic/debug service listening on the network exposes an administrative command-line interface without requiring any credential or session establishment. Because this CLI reaches low-level device functions - filesystem, memory, task scheduler, and I/O state - the missing authentication check on a 'critical function' effectively hands operator-grade control to any peer on the reachable network segment. The vendor's own tag classifies this as an Authentication Bypass, consistent with a debug interface that should have been gated or disabled in production firmware.
RemediationAI
Follow Rockwell Automation advisory SD1785 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1785.html) and apply the vendor-provided firmware update for the 1715-AENTR (patch available per vendor advisory; an exact fixed version was not included in the provided data and must be confirmed from SD1785). Until firmware can be updated, apply compensating controls: place the adapter behind strict network segmentation and an ICS-aware firewall so only trusted engineering hosts can reach it, block or filter access to the debug/CLI service port at the boundary, and disable the debug interface if the firmware exposes a configuration option to do so. Restrict management access to a dedicated, physically or logically isolated OT VLAN and monitor for unexpected connections to the device - the trade-off of aggressive filtering is that legitimate diagnostics and remote maintenance may be interrupted, so coordinate with operations before enforcing.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today