1756-EN2/ENBT Modules CVE-2026-9653

Exploitation requires network-layer reachability to the module's EtherNet/IP/CIP interface and the ability to send crafted CIP Implicit (connected I/O) Connection packets; no authentication, credentials, or user interaction are needed (PR:N/UI:N/AC:L). The limiting factors are practical rather than configuration-based: the attacker must be positioned on a network path that can reach the module's CIP messaging (typically the OT/control segment), and disruption persists only while malicious traffic continues because connections recover immediately once it stops - meaning the attacker must maintain a sustained packet stream to keep the device disrupted. There is no persistence, no privilege escalation, and no data exposure.

The vendor CVSS 4.0 base score is 8.7 (High), driven entirely by high availability impact (VA:H) with a fully remote, low-complexity, unauthenticated vector (AV:N/AC:L/PR:N/UI:N). This is a genuine OT-availability concern: no authentication, no user interaction, and network-reachable. However, the real-world severity is tempered by the description's explicit note that connections recover immediately after the crafted traffic stops - so impact is transient disruption requiring sustained attacker traffic, not a durable outage or safety-state compromise. There is no confidentiality or integrity impact. EPSS is not provided, KEV status is not listed (no active exploitation), and no POC is referenced, so exploitation probability is unquantified but there is no evidence of exploitation in the wild. One data conflict to flag: the Tags include 'Information Disclosure,' which contradicts the description and the CVSS vector (VC:N - no confidentiality impact); the tag appears mislabeled and should be treated as a DoS issue per the authoritative description and vector.

An attacker with access to the industrial network (for example, via a compromised HMI, engineering workstation, or an exposed control segment) sends a stream of crafted CIP Implicit Connection packets to a 1756-EN2/EN3/ENBT module. The malformed packets fail integrity handling and cause active I/O connections to drop, disrupting real-time communication between the controller and downstream devices for as long as the attacker sustains the traffic. No POC is referenced in the provided data.