# Rockwell Automation Communication Modules Vulnerable to Network-Based Denial-of-Service Attack
## The Threat
Rockwell Automation's widely deployed industrial communication modules—the 1756-EN2, 1756-EN3, and 1756-ENBT—contain a critical vulnerability that allows unauthenticated attackers on the network to repeatedly disrupt device connections through specially crafted packets. The flaw exists in how these modules validate the integrity of Common Industrial Protocol (CIP) Implicit Connection packets, leaving them vulnerable to denial-of-service attacks that continuously reset active communications.
The vulnerability is particularly concerning because it requires no authentication or user interaction to exploit. An attacker positioned anywhere on the network—whether physically present or remotely connected through compromised network infrastructure—can craft malicious CIP packets to trigger the vulnerability. While affected devices recover immediately after each attack, an attacker can sustain a continuous assault that repeatedly severs connections, effectively denying legitimate industrial operations.
Rockwell Automation equipment forms the backbone of production lines, power systems, and manufacturing facilities globally. These communication modules function as the bridge between industrial control systems and networks, making them critical access points for operational technology environments. A successful exploitation campaign could force unplanned downtime, disrupt coordinated multi-device operations, and create cascading failures in environments where timing and continuous connectivity are essential.
## Severity and Impact
| CVE | CVSS v3.1 | CVSS v4.0 | Severity | Vector String (v3.1) | Attack Vector | Authentication | CWE |
|---------|---|---|---|---|---|---|---|
| CVE-2026-9653 | 7.5 | 8.7 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | Network | None Required | CWE-354 |
The vulnerability scores across both CVSS versions indicate a high-severity issue. The attack vector is network-based with low complexity, meaning any attacker with network connectivity can attempt exploitation. Confidentiality and integrity remain protected—attackers cannot steal data or modify operations—but availability is severely compromised through denial-of-service.
## Affected Products
Rockwell Automation 1756-EN2 (CompactLogix Ethernet Module)
Rockwell Automation 1756-EN3 (CompactLogix Ethernet Module, Enhanced)
Rockwell Automation 1756-ENBT (CompactLogix Bluetooth Module)
## Mitigations
Immediate Actions:
1. Prioritize Patching: Organizations running 1756-EN2 or 1756-EN3 modules should update immediately to version V12.002, which addresses the integrity validation flaw.
2. Network Segmentation: Implement strict network access controls to limit connectivity to these modules. Isolate industrial control system networks from business networks and public internet access. Deploy firewalls to restrict traffic to only authorized sources and protocols.
3. VPN Requirements: If remote access to systems hosting these modules is necessary, enforce Virtual Private Network (VPN) connections with current security patches. Verify that VPN endpoints authenticate users and enforce additional controls.
4. Monitor for Exploitation: Implement network monitoring to detect repeated failed CIP connection attempts or traffic patterns consistent with DoS attacks against these modules. Alert on anomalous connection state changes.
5. ENBT Workarounds: Organizations unable to immediately replace discontinued 1756-ENBT modules should implement aggressive network isolation and consider switching to alternative communication modules. No vendor patch is available for this end-of-life product.
6. System Architecture Review: Audit production environments to map all affected modules. Develop a phased migration plan for ENBT equipment toward supported alternatives.
Defensive Best Practices:
## References
## HackWire Analysis
This vulnerability exposes a fundamental challenge in legacy industrial automation: Rockwell Automation's installed base spans decades, with equipment operating in production environments that can't simply be powered down for maintenance. The 1756-ENBT's discontinued status is particularly telling—organizations discovered they're running unsupported hardware in critical systems, with no vendor patch forthcoming.
The attack profile here is deceptively simple but operationally devastating. Unlike vulnerabilities requiring exploitation chains or elevated privileges, this flaw operates at the packet level, making it trivial to automate. An attacker doesn't need shell access or deep protocol knowledge—just the ability to send crafted network packets. This accessibility makes the vulnerability broadly exploitable across any manufacturing facility connected to an untrusted network.
What deserves closer attention: the CVSS 7.5 rating undersells the real-world impact in industrial settings. While DoS vulnerabilities traditionally score lower than code execution flaws, the consequences differ significantly. Manufacturing environments operate on razor-thin tolerances. Thirty seconds of downtime in automotive production can cascade into hours of supply-chain disruption. A continuous attack pattern could justify emergency production shutdowns, safety interventions, or manual failovers—each with its own risks.
The Idaho National Laboratory's discovery through defensive research suggests this wasn't found in the wild yet. Organizations have a window to patch and remediate before this becomes actively weaponized. For those running ENBT modules, the clock is ticking differently: replacement is the only viable path forward.
For defenders: prioritize updating EN2 and EN3 modules immediately, but don't stop there. Audit your network to ensure these devices aren't directly reachable from untrusted networks. Implement robust network segmentation between operational technology and information technology domains. And critically, begin the replacement cycle for ENBT equipment now—waiting for an incident is waiting too long.
— HackWire Editorial
## Related Coverage