CVE-2026-9653: 1756 Communication Module DoS Vulnerability

CVE-2026-9653 Overview

CVE-2026-9653 is a denial-of-service (DoS) vulnerability affecting Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT ControlLogix communication modules. The flaw stems from improper validation of Common Industrial Protocol (CIP) Implicit Connection packets [CWE-354]. An unauthenticated attacker on the network can send crafted CIP packets to continuously disrupt device connections. Device connections recover immediately after the malicious traffic stops, but sustained attacks can interrupt industrial control operations. The vulnerability carries a CVSS 4.0 base score of 8.7 and an EPSS probability of 0.178%.

Critical Impact
A network-based attacker without credentials can continuously disrupt CIP Implicit Connections on ControlLogix 1756 communication modules, degrading availability of industrial control operations.

Affected Products

Rockwell Automation 1756-EN2 communication modules (all versions)
Rockwell Automation 1756-EN3 communication modules (all versions)
Rockwell Automation 1756-ENBT communication modules (all versions)

Discovery Timeline

2026-07-14 - CVE-2026-9653 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-9653

Vulnerability Analysis

The affected 1756-EN2, 1756-EN3, and 1756-ENBT modules bridge EtherNet/IP traffic to the ControlLogix backplane. These modules process CIP Implicit Connection packets used for real-time cyclic I/O data exchange between controllers and remote devices. The vulnerability allows a remote, unauthenticated attacker to craft CIP Implicit Connection packets that the module fails to validate correctly. Processing these malformed packets forces the module to drop or reset active connections. The disruption continues while the attacker sustains the crafted traffic, though normal operation resumes once the traffic stops.

Root Cause

The root cause is improper validation of integrity check values in incoming CIP Implicit Connection packets, categorized under CWE-354 (Improper Validation of Integrity Check Value). The module's protocol parser accepts packet fields without sufficient verification, allowing crafted inputs to trigger a fault path in the connection handling logic. This causes the module to tear down legitimate connections rather than rejecting only the malicious traffic.

Attack Vector

Exploitation requires network access to the EtherNet/IP interface exposed by the 1756-EN2, EN3, or ENBT module. No authentication, user interaction, or elevated privileges are required. The attacker crafts CIP packets addressed to the module's Implicit Connection service and transmits them repeatedly. Each malformed packet triggers a disruption of active connections. Because CIP Implicit messaging typically runs on UDP port 2222 with class 0/1 connections, an attacker with layer 3 reachability to the control network can carry out the attack. See the Rockwell Automation Security Advisory SD1780 for vendor technical details.

Detection Methods for CVE-2026-9653

Indicators of Compromise

Repeated CIP Implicit Connection resets or forward-open failures logged by the 1756-EN2, EN3, or ENBT module.
Unexpected drops in controller-to-remote-I/O connections coinciding with EtherNet/IP traffic from unfamiliar source addresses.
Bursts of malformed CIP packets on UDP port 2222 or TCP port 44818 targeting affected modules.

Detection Strategies

Deploy an industrial protocol-aware intrusion detection system (IDS) capable of parsing EtherNet/IP and CIP to flag malformed Implicit Connection packets.
Baseline normal CIP Implicit Connection counts per module and alert on abnormal churn or repeated forward-close events.
Correlate module diagnostic logs with network capture data to identify the source of packets triggering connection resets.

Monitoring Recommendations

Monitor Rockwell 1756 module status LEDs and diagnostic web pages for repeated communication faults.
Ingest EtherNet/IP session and connection telemetry into a SIEM to alert on sustained anomalies.
Track east-west traffic on the control network for unauthorized hosts communicating with 1756 modules.

How to Mitigate CVE-2026-9653

Immediate Actions Required

Review Rockwell Automation advisory SD1780 and identify all 1756-EN2, 1756-EN3, and 1756-ENBT modules in the environment.
Restrict EtherNet/IP access to affected modules using firewall rules and industrial DMZ segmentation aligned with ISA/IEC 62443.
Disable or block CIP traffic from any host that does not require communication with the affected modules.

Patch Information

Refer to the Rockwell Automation Security Advisory SD1780 for the current list of fixed firmware versions and vendor-recommended mitigations. Apply the vendor-supplied firmware update to affected modules following change control procedures for the operational technology (OT) environment.

Workarounds

Place affected 1756 modules behind a CIP-aware firewall that filters malformed Implicit Connection packets.
Use CIP Security or equivalent authenticated transport where supported by the module and controller firmware.
Enforce strict allow-listing of source IP addresses permitted to open CIP connections to the module.

bash

# Example firewall allow-list restricting CIP traffic to authorized controllers
iptables -A FORWARD -s 10.10.20.0/24 -d 10.10.30.15 -p udp --dport 2222 -j ACCEPT
iptables -A FORWARD -s 10.10.20.0/24 -d 10.10.30.15 -p tcp --dport 44818 -j ACCEPT
iptables -A FORWARD -d 10.10.30.15 -p udp --dport 2222 -j DROP
iptables -A FORWARD -d 10.10.30.15 -p tcp --dport 44818 -j DROP