EUVD-2026-98745
GHSA-h935-ghxg-4xm5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device on OT network
-
DeliveryFlood open TCP/UDP ports with storm traffic
-
ExploitExhaust resource handling (CWE-770)
-
ExecutionDevice faults and halts communication
-
ImpactProcess disruption until manual power cycle
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the 1732E ArmorBlock I/O module and the ability to generate high-volume 'network storm' traffic against its open TCP and UDP ports (CWE-770, uncontrolled resource allocation). No authentication, privileges, or user interaction are needed (PR:N/UI:N), and default configurations are affected. The primary LIMITING factor is network exposure: these are OT/ICS field devices normally expected to sit on segmented industrial networks, so realistic risk is confined to environments where the module is reachable from untrusted or flat networks. Recovery requires a manual power cycle, amplifying operational impact where physical access is constrained. |
| Impact | This is a genuine availability-focused risk for operational technology environments, but not a confidentiality/integrity threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability with no user interaction - meaning any attacker (or even accidental traffic) able to reach the device's network can trigger it. Impact is strictly availability (VC:N/VI:N/VA:H): the device faults and requires a manual power cycle to recover, which is operationally severe in an ICS context where physical access for a reboot may be slow or dangerous. However, several real-risk signals are MISSING from the input: there is no EPSS score, no CISA KEV listing, and no POC indicator provided, so exploitation probability cannot be quantified and status is 'no public exploit identified at time of analysis.' The CWE-770 (uncontrolled resource allocation / network storm) root cause means exploitation is as simple as flooding open TCP/UDP ports, so the 8.7 score is justified by ease and physical-recovery impact rather than by observed exploitation. Overall: a real priority for OT asset owners who expose these I/O modules to reachable networks, but there is no evidence of active or widespread exploitation - treat as a patch/segmentation priority, not an incident. |
| Exploit ScenarioDerived | An attacker with network reachability to the 1732E ArmorBlock I/O module sends a high-volume network storm (flood of traffic to open TCP/UDP ports), overwhelming the device's resource handling. The module faults and halts communication, disrupting the industrial process until an operator physically power-cycles it. No public exploit code is identified, but the low attack complexity and no-privilege/no-interaction vector make crafting such traffic trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Network storm traffic directed at Rockwell Automation 1732E ArmorBlock I/O modules can exhaust device resources and interrupt communications, causing the module to fault and stop responding on its open TCP and UDP ports; recovery requires a manual power cycle. The CPE data covers the 1732E ArmorBlock I/O product line broadly, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, vendor score 8.7 under CVSS 4.0) confirms this is an unauthenticated, remote, availability-only condition with no confidentiality or integrity impact. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, so the realistic risk is concentrated in OT/ICS environments where these field devices are reachable from flat or untrusted networks, especially where a power cycle requires physical site access.
RemediationAI
The primary action is to apply the firmware or mitigation prescribed in Rockwell Automation's advisory SD1801 (https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1801.html); no specific patched firmware version is confirmed in the available data, so verify the fixed revision directly with the vendor rather than assuming a version number, and treat the advisory as the authoritative source for patch status. Where an upgrade cannot be scheduled immediately, the highest-value compensating control is network segmentation: place 1732E ArmorBlock I/O modules behind a firewall or industrial DMZ so they are not reachable from untrusted or flat corporate networks, which directly removes the network-reachability prerequisite for exploitation - the trade-off is added engineering effort and the need to maintain accurate conduit rules so legitimate control traffic is not blocked. Second, apply switch-level storm control, broadcast/multicast rate limiting, and ingress ACLs restricting which source addresses may reach the module's TCP and UDP ports; these bound the traffic volume that reaches the device, though overly aggressive thresholds can drop legitimate industrial protocols, so tune against baseline traffic. Third, disable any unused services on the module to shrink the set of reachable ports, accepting that the ports required for normal I/O communication cannot be closed without breaking the control function. Finally, because recovery requires a manual power cycle, plan for physical or remote-power access to affected units and monitor for link/communication loss so that a storm-induced fault can be detected and cleared quickly; this is a response-time mitigation, not a preventive one.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-770 (Allocation of Resources Without Limits or Throttling), combined with improper handling of high-volume 'network storm' traffic on the module's exposed TCP and UDP services. Rather than a memory-corruption or injection flaw, this is a resource-exhaustion condition: sustained broadcast/multicast or otherwise abnormal traffic delivered to the device's network stack is not bounded or filtered, so the firmware's communication handling degrades until the module faults. The CVE record is attributed to Rockwell Automation and the CPE cpe:2.3:a:rockwell_automation:1732e_armorblock®_i/o:*:*:*:*:*:*:*:* uses a wildcard version, indicating the advisory covers the product line rather than a single firmware revision; the CPE itself does not identify a fixed version, so firmware-level fix status must be confirmed from the vendor advisory. Because the affected ports are the device's normal industrial communication endpoints, the attack surface is inherent to the product's function and cannot be removed by simply disabling a non-essential service. The CVSS 4.0 vector supplied by the vendor places all impact in the vulnerable system's availability (VA:H) with no subsequent-system impact, which is consistent with a single field device becoming unresponsive while the surrounding control network continues to operate.
Know when 1732E Armorblock I O gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote network storm needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only device fault requiring power cycle (C:N/I:N/A:H), with no scope change.
Primary rating from Vendor (Rockwell).
CVSS VectorVendor: Rockwell
DescriptionCVE.org
A denial-of-service security issue exists in the affected product and version. The security issue stems from improper handling of network storm traffic, which can interrupt communication, cause device faults, and affect open TCP and UDP ports. A power cycle is required to recover the device to its normal state.
Executive ViewAI
Rockwell Automation 1732E ArmorBlock I/O modules, used in industrial control environments, can be disrupted by network storm traffic, causing communication outages that require physical power cycles to restore. Organizations with these modules exposed on flat or untrusted networks face operational downtime and potential safety or production impacts, especially where field devices are difficult to access. Leadership should treat this as a high-priority availability risk because no vendor-released patch has been identified at this time.
No vendor-released patch identified; interim mitigations include network segmentation, ACLs to block storm traffic, storm control and rate limiting on switches, restricting access to trusted hosts, continuous monitoring for device faults, and pre-planned physical power cycle procedures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB