1794-AENTR Adapter EUVD-2026-37122

No special conditions - the attacker only needs network reachability to TCP/80 on the 1794-AENTR adapter's embedded web server and the ability to send a crafted HTTP GET to the specific password-change endpoint; no credentials, no user interaction, and no non-default configuration are required per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N). Realistic limiting factors are deployment-driven rather than vulnerability-driven: 1794-AENTR adapters are ICS devices that in well-segmented plants are isolated on dedicated OT VLANs unreachable from IT or the Internet, so exploitation in practice requires either an attacker foothold inside the OT zone (compromised engineering workstation, vendor remote-access tunnel, flat network) or an exposed/mis-segmented adapter.

All signals converge on high real-world risk for exposed devices: the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates remote, unauthenticated, low-complexity exploitation with no user interaction, and the vulnerable-system impacts VI:H/VA:H reflect that an attacker fully controls authentication state and can lock out legitimate operators. There is no EPSS score, KEV listing, or public POC referenced in the provided data, so this is not confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis - however, because 1794-AENTR adapters are ICS components that should never be Internet-exposed, the practical risk concentrates on environments where OT/IT segmentation is weak or where engineering workstations share the L2 segment. Conflict to note: CVSS 4.0 rates VC:L (low confidentiality) while the description emphasizes account takeover, which in practice may yield higher confidentiality impact once the attacker logs in with the new password - Rockwell's advisory SD1775 should be consulted for authoritative impact scoping.

An attacker with network reach to the OT segment - for example, a contractor laptop, a compromised engineering workstation, or a poorly segmented IT/OT bridge - issues a single crafted HTTP GET request to the 1794-AENTR's password-change endpoint and immediately sets a new web interface password of their choosing. They then authenticate with the new credential, lock out plant operators, and use the web interface for further reconnaissance or to disrupt EtherNet/IP communications to downstream Flex I/O modules. No POC is referenced in the provided data, but the exploitation primitive is a single HTTP request and is trivially reproducible.