EUVD-2026-37121
GHSA-42rg-42xm-fx4v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to OT network segment
-
DeliveryIdentify 1794-AENTR via EtherNet/IP discovery
-
ExploitSend malformed CIP requests
-
ExecutionTrigger memory leak in adapter firmware
-
PersistAdapter faults and drops I/O connections
-
ImpactProcess visibility lost until manual reset
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | The attacker needs IP-level reachability to the 1794-AENTR's EtherNet/IP CIP service (typically TCP/44818 and UDP/2222) and the ability to send malformed or specifically crafted CIP protocol requests - no authentication, user interaction, or non-default configuration is required per CVSS PR:N/UI:N/AT:N. The realistic limiter is network exposure: 1794-AENTR adapters are deployed inside OT/ICS networks and should not be Internet-reachable in a properly segmented Purdue-model architecture, so exploitation in practice requires a foothold on a network with routed access to the control segment. |
| Impact | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VA:H confirms a remote, unauthenticated, low-complexity attack that produces high availability impact and no confidentiality or integrity impact - consistent with the DoS description. No EPSS score, KEV listing, or public POC was provided, so exploitation likelihood signals are absent. For an OT/ICS asset this is still a serious operational concern: faulting a FLEX I/O adapter drops process I/O until a physical reset, which in a running plant translates to unplanned downtime or safety-relevant loss of visibility. One inconsistency worth noting: the input tags include 'Information Disclosure,' which contradicts the CVSS (VC:N) and the description (pure DoS) - the tag appears to be mislabeled and should not drive prioritization. |
| Exploit ScenarioDerived | An attacker with network reachability to the OT segment - for example via a compromised engineering workstation, exposed remote-access VPN, or flat IT/OT network - sends a sequence of crafted CIP requests to the 1794-AENTR's EtherNet/IP service. The adapter leaks memory until it faults, dropping all connected FLEX I/O modules and halting process visibility until an operator physically resets the device. No public exploit identified at time of analysis, but the protocol-level nature of the bug means a single-packet or short-sequence POC is plausible once details are reverse-engineered from the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Denial-of-service in Rockwell Automation 1794-AENTR FLEX I/O EtherNet/IP adapters allows remote unauthenticated attackers to fault the device and sever its connection to associated I/O modules via malformed CIP protocol requests. Recovery requires a manual reset, making this a high-impact availability issue for industrial control environments where uptime is critical. No public exploit identified at time of analysis, but the CVSS 4.0 score of 8.7 reflects the network-reachable, no-privilege attack path against operational technology.
RemediationAI
Patch status from available data is unclear - Patch available per vendor advisory SD1775 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1775.html), and operators should consult that bulletin for the exact fixed firmware revision before scheduling a maintenance window. Where immediate firmware update is not feasible, segment the control network so the 1794-AENTR is reachable only from trusted engineering workstations and PLCs, block EtherNet/IP (TCP/44818, UDP/2222) at the IT/OT boundary, and apply CIP-aware deep packet inspection on an industrial firewall to drop malformed requests; the trade-off is that overly aggressive filtering can disrupt legitimate Class 1 I/O traffic, so test in a staging cell first. Monitor adapter health via the controller and alert on connection loss so a manual reset can be performed promptly if exploitation occurs.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The 1794-AENTR is a FLEX I/O EtherNet/IP communication adapter from Rockwell Automation that bridges distributed I/O modules to a control network using the Common Industrial Protocol (CIP) over EtherNet/IP. CWE-401 (Missing Release of Memory after Effective Lifetime) indicates a memory leak: as the adapter processes specific CIP requests, allocated memory is not freed, eventually exhausting resources and causing a fault state. CIP is the application-layer protocol carried over EtherNet/IP (TCP/44818 and UDP/2222), and its parsing logic in resource-constrained embedded firmware is a recurring source of robustness issues across ICS vendors.
Know when Flex I O Ethernet Ip Adapters gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote network-reachable CIP service, no auth or user interaction, low complexity; impact is pure availability (adapter fault requiring manual reset), no confidentiality or integrity loss.
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
DescriptionCVE.org
A denial-of-service security issue exists within the 1794-AENTR adapter due to improper memory handling of CIP protocol requests. This vulnerability can result in the adapter faulting and losing connection to its associated I/O modules, requiring a manual reset to recover.
Executive ViewAI
Rockwell Automation FLEX I/O EtherNet/IP adapters (model 1794-AENTR) are vulnerable to a remote denial-of-service attack that disables the device and severes connections to industrial I/O modules, requiring manual intervention to restore. This impacts manufacturing facilities and critical infrastructure operators relying on these adapters for continuous production or process control. With no available patch, organizations face immediate operational risk for any connected 1794-AENTR devices.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to 1794-AENTR adapters via firewall rules limiting CIP protocol exposure to trusted engineering networks; (2) deploy network intrusion detection rules for malformed CIP requests; (3) maintain expedited manual reset procedures and ensure staffing for rapid recovery; (4) evaluate device replacement for mission-critical deployments pending official patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB