EUVD-2026-43712
GHSA-vxg7-9hgq-fphj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated crafted-packet DoS with no user interaction, so AV:N/AC:L/PR:N/UI:N; impact is availability-only (module halt until power cycle), hence C:N/I:N/A:H.
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A denial-of-service security issue exists in the affected products. The security issue stems from improper handling of exceptional conditions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.
AnalysisAI
Remote denial-of-service in the Rockwell Automation FLEX 5000 EtherNet/IP adapter allows an unauthenticated network attacker to crash the module by sending a crafted CIP (Common Industrial Protocol) packet, halting the adapter and its associated I/O until a manual power cycle restores operation. The CVSS 4.0 score of 8.7 (High) reflects a network-reachable, no-privilege attack with high availability impact but no confidentiality or integrity loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to send a crafted CIP (Common Industrial Protocol) packet over EtherNet/IP to the FLEX 5000 adapter - the specific trigger is a malformed CIP message that hits the module's exceptional-condition handling. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are largely consistent for a serious availability threat but a bounded one. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a foothold on the OT/control network (via a compromised engineering workstation, an exposed jump host, or an insufficiently segmented IT/OT boundary) sends a single crafted CIP packet to the FLEX 5000 EtherNet/IP adapter. The double-free is triggered during parsing, the adapter firmware crashes, and the module plus its attached I/O drop offline until an operator physically power-cycles the hardware. … |
| Remediation | Consult Rockwell Automation advisory SD1789 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1789.html) and apply the vendor-supplied firmware update for the FLEX 5000 EtherNet/IP adapter; no exact fixed firmware version is provided in the available data, so the precise patch level must be confirmed from that advisory (Patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FLEX 5000 adapters in production and document network exposure-specifically identifying which devices are accessible from untrusted or external networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-415 – Double Free
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today