CVE-2026-10573 Overview
CVE-2026-10573 is a denial-of-service vulnerability affecting the Rockwell Automation 1734 POINT I/O™ module. The flaw stems from improper handling of crafted Common Industrial Protocol (CIP) messages, which force the module into a faulted state. Recovery requires a manual restart of the affected device. The weakness maps to [CWE-770] Allocation of Resources Without Limits or Throttling. An unauthenticated remote attacker with network access to the module can trigger the condition without user interaction.
Critical Impact
A remote unauthenticated attacker can halt operations of the 1734 POINT I/O™ module by sending malformed CIP traffic, requiring physical or administrative intervention to restore service.
Affected Products
- Rockwell Automation 1734 POINT I/O™ module
- Deployments using CIP over network interfaces
- Industrial control systems (ICS) integrating the affected I/O module
Discovery Timeline
- 2026-07-14 - CVE-2026-10573 published to the National Vulnerability Database (NVD)
- 2026-07-14 - Last updated in NVD database
Technical Details for CVE-2026-10573
Vulnerability Analysis
The 1734 POINT I/O™ module processes CIP messages as part of standard EtherNet/IP communications used across industrial environments. The vulnerability arises when the module receives specifically crafted CIP messages that its input validation logic does not handle safely. Instead of rejecting malformed input, the module transitions into a faulted state and stops servicing legitimate traffic.
Because the module governs digital and analog I/O in industrial processes, a faulted state can interrupt automation workflows, safety interlocks, and monitoring functions. Restoring operations requires an operator to restart the module, which extends the impact window beyond the attack itself. The vulnerability is classified under [CWE-770], reflecting a lack of resource control when processing untrusted protocol input.
Root Cause
The root cause is improper handling of crafted CIP messages within the module firmware. Input parsing routines fail to constrain or validate malformed protocol fields before processing them, permitting an attacker-controlled message to place the device into an unrecoverable running state. No authentication or user interaction is required to reach the vulnerable code path.
Attack Vector
The attack vector is network-based over CIP/EtherNet/IP. An attacker with reachability to the module—directly connected, or via a flat OT network segment—can send crafted CIP packets that trigger the fault. The EPSS score is 0.253% (percentile 16.753 as of 2026-07-20), and no public exploit or CISA KEV listing exists at publication.
No verified proof-of-concept code is publicly available. Refer to the Rockwell Automation Security Advisory SD1779 for vendor technical details.
Detection Methods for CVE-2026-10573
Indicators of Compromise
- Unexpected transitions of 1734 POINT I/O™ modules into a faulted state without process-related cause
- Loss of communication with I/O modules requiring manual restart to restore
- CIP traffic from unexpected source addresses or outside normal engineering workstations
Detection Strategies
- Deploy ICS-aware intrusion detection sensors that parse CIP and EtherNet/IP for malformed messages
- Baseline normal CIP message patterns and alert on anomalous field structures or unusual command frequencies
- Correlate module fault events in the controller logs with concurrent network activity from non-engineering hosts
Monitoring Recommendations
- Forward controller and module diagnostic events to a centralized SIEM for correlation with network telemetry
- Monitor EtherNet/IP traffic at OT/IT boundaries and inside cell/area zones for unauthorized CIP peers
- Track module uptime and fault-clear events as security-relevant signals, not only reliability metrics
How to Mitigate CVE-2026-10573
Immediate Actions Required
- Review the Rockwell Automation Security Advisory SD1779 for affected firmware revisions and apply vendor-provided updates
- Restrict network reachability to the 1734 POINT I/O™ modules so that only authorized engineering workstations and controllers can send CIP traffic
- Segment OT networks from IT networks using firewalls and CIP-aware inspection
Patch Information
Rockwell Automation has published advisory SD1779 with remediation guidance for CVE-2026-10573. Operators should consult the vendor advisory to identify fixed firmware versions and follow validated change-control procedures before deployment. Apply patches during planned maintenance windows to avoid unplanned process disruption.
Workarounds
- Place affected modules behind an industrial firewall configured to allow CIP only from known controllers and engineering stations
- Disable or block EtherNet/IP traffic from untrusted VLANs and remote access paths that do not require it
- Implement strict access control lists on managed switches to isolate the module subnet
# Example: block CIP/EtherNet/IP from untrusted sources at an OT firewall
# CIP uses TCP/44818 (explicit) and UDP/2222 (implicit I/O)
iptables -A FORWARD -s <untrusted_subnet> -p tcp --dport 44818 -j DROP
iptables -A FORWARD -s <untrusted_subnet> -p udp --dport 2222 -j DROP
iptables -A FORWARD -d <point_io_subnet> -p tcp --dport 44818 -m set ! --match-set trusted_hosts src -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
