CVE-2026-0646 Overview
CVE-2026-0646 is a denial-of-service vulnerability in the Rockwell Automation 1794-AENTR FLEX I/O EtherNet/IP adapter. The flaw stems from improper memory handling when the adapter processes Common Industrial Protocol (CIP) requests. A remote, unauthenticated attacker can send crafted CIP traffic over the network to cause the adapter to fault and disconnect from its associated I/O modules. Recovery requires a manual reset, interrupting industrial control processes that depend on the adapter. The weakness is classified as a missing release of memory after effective lifetime [CWE-401].
Critical Impact
Successful exploitation causes the 1794-AENTR adapter to fault, severing communication with downstream I/O modules and forcing manual intervention to restore operations.
Affected Products
- Rockwell Automation 1794-AENTR FLEX I/O EtherNet/IP Adapter
- Industrial control systems integrating the 1794-AENTR adapter
- Operational technology (OT) networks exposing CIP services on this adapter
Discovery Timeline
- 2026-06-16 - CVE-2026-0646 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-0646
Vulnerability Analysis
The 1794-AENTR adapter exposes EtherNet/IP and CIP services to remote clients on industrial networks. The vulnerability arises from improper memory handling while parsing or processing CIP protocol requests. Repeated or malformed requests exhaust adapter resources, leading to a fault condition. Once the adapter faults, it loses its connection to the FLEX I/O modules it serves, halting input acquisition and output control until an operator performs a manual reset.
The issue is network-reachable and requires no authentication or user interaction. Because the adapter sits at the boundary between control logic and field devices, a fault propagates into loss of process visibility and actuation.
Root Cause
The defect is a missing release of memory after effective lifetime, tracked as [CWE-401]. The adapter firmware does not consistently free memory allocated during CIP request handling. Sustained traffic drives the device into a resource-exhausted state from which it cannot self-recover.
Attack Vector
An attacker with network access to the adapter sends crafted or repeated CIP requests over EtherNet/IP. No credentials or operator interaction are required. The vulnerability does not enable code execution, data tampering, or information disclosure; impact is limited to availability of the adapter and its I/O modules. Refer to the Rockwell Automation Security Advisory SD1775 for protocol-level specifics.
Detection Methods for CVE-2026-0646
Indicators of Compromise
- Unexpected fault states reported by 1794-AENTR adapters and concurrent loss of communication with attached FLEX I/O modules.
- Unscheduled manual resets of adapters logged by control engineers or HMI alarm histories.
- Anomalous spikes in inbound EtherNet/IP or CIP traffic to adapter IP addresses, particularly from hosts outside the engineering workstation segment.
Detection Strategies
- Baseline normal CIP request rates per adapter and alert on deviations that correlate with adapter faults.
- Inspect EtherNet/IP traffic on TCP/UDP port 44818 and CIP class/service codes for malformed or repetitive request patterns.
- Correlate PLC diagnostic tags reporting adapter connection loss with network telemetry from the same time window.
Monitoring Recommendations
- Forward adapter diagnostic and PLC controller logs to a centralized SIEM for cross-correlation with network sensor data.
- Deploy passive OT network monitoring at the cell/area zone to record CIP sessions targeting 1794-AENTR devices.
- Configure alerting on repeated adapter reset events within short time windows as a potential exploitation signal.
How to Mitigate CVE-2026-0646
Immediate Actions Required
- Review the Rockwell Automation Security Advisory SD1775 and inventory all 1794-AENTR adapters across the environment.
- Apply the vendor-provided firmware update to affected adapters as soon as it can be scheduled within change-control windows.
- Restrict network reachability to adapter management and CIP ports from any system that does not require it.
Patch Information
Rockwell Automation has published advisory SD1775 describing the affected versions and remediated firmware for the 1794-AENTR adapter. Operators should consult the advisory for the exact fixed firmware revisions and follow Rockwell's documented upgrade procedure to avoid disrupting active control sessions.
Workarounds
- Segment OT networks so that only authorized engineering workstations and controllers can reach the adapter over EtherNet/IP.
- Enforce ingress filtering on industrial firewalls to block CIP traffic originating from IT or untrusted networks.
- Disable or restrict unused CIP services on the adapter where the firmware allows, reducing exposed attack surface.
- Maintain documented manual reset procedures so operators can restore service quickly if an adapter faults.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
