Flex 5000 Adapter CVE-2026-12659

Exploitation requires the attacker to send a crafted CIP (Common Industrial Protocol) packet over EtherNet/IP to the FLEX 5000 adapter - the specific trigger is a malformed CIP message that hits the module's exceptional-condition handling. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N), no authentication, no user interaction, and no special attack requirement are needed against a reachable adapter. The primary limiting factor is network position: the attacker must have Layer-3/Layer-2 reachability to the adapter's EtherNet/IP interface, so effective exploitation depends on how well the control network is segmented from IT and external networks. Impact is limited to availability (VA:H) - no data disclosure or integrity compromise - and recovery mandates a manual power cycle of the module and its associated I/O.

The signals are largely consistent for a serious availability threat but a bounded one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction, and the impact metrics (VC:N/VI:N/VA:H) confine the effect to availability - this is a pure DoS, not code execution, despite the misleading 'Information Disclosure' tag, which contradicts the vector and should be disregarded. No EPSS score, no POC, and no KEV listing were provided, so probabilistic and real-world-exploitation signals are absent rather than reassuring; the practical risk is dominated by network exposure. In OT environments where the control network is properly segmented, exploitation requires an attacker to already be on that network, which meaningfully limits opportunity; where EtherNet/IP is flat or bridged, the low complexity and lack of authentication make disruption easy. The recovery requirement (manual power cycle of the module and its I/O) elevates operational impact beyond a transient crash, since it can force a plant-floor outage and physical intervention. Note the tags conflict with the CVSS impact metrics - treat the vector as authoritative and verify scope with Rockwell advisory SD1789.

An attacker with a foothold on the OT/control network (via a compromised engineering workstation, an exposed jump host, or an insufficiently segmented IT/OT boundary) sends a single crafted CIP packet to the FLEX 5000 EtherNet/IP adapter. The double-free is triggered during parsing, the adapter firmware crashes, and the module plus its attached I/O drop offline until an operator physically power-cycles the hardware. No credentials, user interaction, or special attack requirements are needed, though the attacker must first reach the EtherNet/IP network; no public POC is currently identified.