Which versions of 1756-EN2/ENBT Modules are affected by CVE-2026-9653?

ControlLogix communication modules (1756-EN2, 1756-EN3, 1756-ENBT) deployed in manufacturing and utility environments are vulnerable to network-based denial-of-service attacks that repeatedly…

How to fix or mitigate CVE-2026-9653?

Within 24 hours, identify all ControlLogix modules 1756-EN2, 1756-EN3, and 1756-ENBT in your environment and assess their operational criticality; implement firewall rules to restrict CIP traffic to these modules from untrusted network sources. Within 7 days, deploy network intrusion detection signatures for malformed CIP Implicit Connection packets, establish baseline network monitoring, and evaluate network segmentation or air-gapping options for critical systems. Within 30 days, subscribe to Rockwell Automation security advisories for patch availability updates and develop a contingency plan for module replacement if patches are not released within your organization's risk tolerance window.

1756-EN2/ENBT Modules CVE-2026-9653

Q: What is the CVSS score of CVE-2026-9653?

CVE-2026-9653 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-43695 HIGH

Improper Validation of Integrity Check Value (CWE-354)

2026-07-14 Rockwell

GHSA-w8xr-7458-qr4m

Information Disclosure 1756 Enbt 1756 En2 1756 En3 Rockwell Automation

8.7

CVSS 4.0 · Vendor: Rockwell

Severity by source

Vendor (Rockwell) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity CIP packet triggers availability-only impact (A:H); no confidentiality or integrity effect, though disruption is transient and self-recovering.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Rockwell).

CVSS VectorVendor: Rockwell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 15:35 vuln.today

CVE Published

Jul 14, 2026 - 15:00 cve.org

HIGH 8.7

DescriptionCVE.org

A denial-of-service security issue exists across all the 1756-EN2, EN3, and ENBT communication module due to improper validation of CIP Implicit Connection packets. An attacker on the network can exploit this by sending crafted packets to continuously disrupt device connections, though device connections will recover immediately after.

AnalysisAI

Denial-of-service in Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT ControlLogix EtherNet/IP communication modules lets an unauthenticated network attacker drop active device connections by sending malformed CIP Implicit (I/O) Connection packets. Because CVSS 4.0 rates only availability impact (VC:N/VI:N/VA:H) and connections recover immediately once the traffic stops, the flaw enables repeatable disruption rather than persistent outage or code execution. No public exploit identified at time of analysis, and the module is not in CISA KEV.

Technical ContextAI

The affected products are Rockwell Automation ControlLogix communication bridge modules (1756-EN2, 1756-EN3, 1756-ENBT) that carry EtherNet/IP traffic between the ControlLogix backplane and industrial networks. The defect lies in how the module validates CIP (Common Industrial Protocol) Implicit Connection packets - the connected, cyclic UDP messaging used for real-time I/O data exchange. CWE-354 (Improper Validation of Integrity Check Value) indicates the module accepts and acts on Implicit Connection packets without adequately verifying their integrity, so crafted packets are processed in a way that tears down or resets legitimate connections. Implicit messaging is a core, always-on function of these modules in any EtherNet/IP control deployment, making the affected code path reachable in normal operation.

RemediationAI

Patch available per vendor advisory: consult Rockwell Automation Security Advisory SD1780 at https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1780.html for the corrected firmware revision, as no exact fix version is included in the provided data - apply the vendor-specified firmware update to the 1756-EN2, 1756-EN3, and 1756-ENBT modules. Where immediate patching is not feasible in a controlled OT change window, restrict EtherNet/IP/CIP reachability by segmenting the control network behind an OT firewall and permitting CIP UDP (implicit I/O, port 2222) and TCP 44818 only from trusted controllers and engineering workstations; this reduces exposure but does not eliminate risk from an attacker already inside the control segment. Because the disruption self-recovers, monitoring for repeated CIP connection resets can serve as a detection compensating control, though it does not prevent the disruption itself.