CVE-2026-35225: CODESYS EtherNet/IP Adapter DoS Flaw

CVE-2026-35225 Overview

CVE-2026-35225 is a resource exhaustion vulnerability in the CODESYS EtherNet/IP adapter stack that allows an unauthenticated remote attacker to exhaust all available TCP connections. This denial of service condition prevents legitimate clients from establishing new connections to affected industrial control systems, potentially disrupting critical operational technology (OT) environments.

Critical Impact

Unauthenticated attackers can remotely exhaust TCP connections in industrial control systems, causing denial of service to legitimate operations without any user interaction required.

Affected Products

• CODESYS EtherNet/IP adapter stack (specific versions detailed in vendor advisory)

Discovery Timeline

• April 23, 2026 - CVE-2026-35225 published to NVD
• April 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35225

Vulnerability Analysis

This vulnerability is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions). The CODESYS EtherNet/IP adapter stack fails to properly handle or limit TCP connection requests, allowing an attacker to consume all available connection slots. Once exhausted, the system cannot accept new legitimate connections, effectively denying service to authorized clients.

The network-based attack vector requires no privileges or user interaction, making it particularly dangerous in industrial environments where availability is paramount. The vulnerability specifically impacts availability without affecting confidentiality or integrity of the system.

Root Cause

The root cause stems from improper handling of exceptional network conditions within the EtherNet/IP adapter stack. The implementation lacks adequate connection rate limiting and fails to properly validate or restrict the number of concurrent TCP connections from individual sources. This allows attackers to rapidly consume connection resources without proper checks for unusual connection patterns or resource exhaustion conditions.

Attack Vector

The attack can be executed remotely over the network by an unauthenticated attacker. The attacker initiates numerous TCP connection requests to the EtherNet/IP adapter, exhausting the finite pool of available connections. The low complexity of this attack, combined with the absence of authentication requirements, makes it particularly accessible to threat actors targeting industrial control systems.

An attacker would establish multiple TCP connections to the target system's EtherNet/IP service port, holding these connections open to prevent new legitimate connections from being established. The attack does not require specialized tools beyond basic network capabilities and can be sustained with minimal resources on the attacker's end while causing significant operational disruption to the target.

Detection Methods for CVE-2026-35225

Indicators of Compromise

• Unusual spike in TCP connection attempts to EtherNet/IP service ports from single or multiple source IP addresses
• Connection table exhaustion warnings or errors in system logs
• Legitimate clients reporting inability to connect to CODESYS-based controllers
• Abnormally high number of half-open or established connections from unexpected sources

Detection Strategies

• Monitor TCP connection states and counts on industrial control system network interfaces
• Implement network flow analysis to detect connection flooding patterns targeting EtherNet/IP ports
• Configure alerting thresholds for connection table utilization on affected devices
• Deploy network intrusion detection signatures for TCP connection exhaustion attempts

Monitoring Recommendations

• Establish baseline connection patterns for normal EtherNet/IP operations and alert on deviations
• Implement continuous monitoring of device availability and connection responsiveness
• Log and analyze all connection attempts to industrial control system endpoints
• Correlate network traffic anomalies with device performance degradation indicators

How to Mitigate CVE-2026-35225

Immediate Actions Required

• Review the CERTVDE Advisory VDE-2026-040 for vendor-specific remediation guidance
• Implement network segmentation to restrict access to CODESYS EtherNet/IP services from untrusted networks
• Deploy firewall rules to limit connection rates from individual source IP addresses
• Enable connection monitoring and alerting on affected industrial control systems

Patch Information

Consult the official CERTVDE Security Advisory 2026-040 for detailed patch availability and installation instructions. Organizations should prioritize applying vendor-released updates to affected CODESYS EtherNet/IP adapter implementations.

Workarounds

• Implement strict network access controls limiting EtherNet/IP access to authorized IP addresses only
• Deploy connection rate limiting at the network perimeter or inline security devices
• Consider deploying industrial-grade firewalls with protocol-aware filtering for EtherNet/IP traffic
• Establish redundant communication paths where operational requirements permit

# Example firewall rate limiting configuration (adapt to your environment)
# Limit new TCP connections to EtherNet/IP port from single source
iptables -A INPUT -p tcp --dport 44818 -m conntrack --ctstate NEW -m recent --set
iptables -A INPUT -p tcp --dport 44818 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 20 -j DROP