Rockwell FLEX I/O adapters expose critical DoS, auth bypass
Two vulnerabilities in Rockwell Automation FLEX I/O EtherNet/IP adapters allow unauthenticated attackers to cause denial of service and take over device web interfaces.
CISA has published an advisory for two vulnerabilities affecting Rockwell Automation FLEX I/O EtherNet/IP adapters used in critical manufacturing environments worldwide. CVE-2026-0646 is a denial-of-service flaw caused by improper memory handling of CIP protocol requests, which can cause the adapter to fault and lose connection to associated I/O modules, requiring manual reset. CVE-2026-0647 is an authentication bypass in the embedded web server that allows unauthenticated attackers to change the device password via a crafted HTTP GET request, enabling unauthorized access and account takeover.
Both vulnerabilities affect versions 2.012 of the 1794-AENTR and 1794-AENTRXT adapters. Rockwell Automation has released version 2.013 to address these issues. The vendor self-reported these vulnerabilities to CISA, and no known public exploitation has been reported at this time.
CISA recommends affected organizations update to the patched version and implement standard ICS security practices including network segmentation, firewall protection, and restricting internet exposure of control system devices.
Mentioned in this report
Detection guidance
Unauthenticated HTTP GET Password Change Attempt on Rockwell FLEX I/O Web Server
Detects an HTTP GET request to a Rockwell FLEX I/O EtherNet/IP adapter's embedded web server containing password-change parameters without prior authentication, consistent with CVE-2026-0647 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated HTTP GET Password Change Attempt on Rockwell FLEX I/O Web Server
id: 7d745b12-5727-5052-8fa8-0f26158b8c80
status: experimental
description: Detects an HTTP GET request that attempts to alter the device password
on a Rockwell FLEX I/O adapter's embedded web interface, matching the CVE-2026-0647
auth bypass pattern where a crafted GET request changes credentials without authentication.
references:
- CISA advisory Rockwell FLEX I/O CVE-2026-0646 CVE-2026-0647
author: Vorant
tags:
- attack.t1190
- attack.initial_access
logsource:
category: proxy
product: null
detection:
selection:
c-method: GET
c-uri|contains:
- password=
- passwd=
- newpassword=
- setpassword
filter:
c-uri|contains:
- /login
- session_token=
condition: selection and not filter
falsepositives:
- Legitimate administrative password change performed through the vendor-supported
authenticated web UI workflow, which normally uses POST rather than GET
- Vulnerability scanning or configuration audit tools intentionally probing the device
for this CVE
level: high
Repeated CIP Protocol Requests to EtherNet/IP Adapter Management Port (Possible DoS)
Flags network connections to the CIP/EtherNet-IP service ports (44818/TCP, 2222/UDP) on FLEX I/O adapters originating from hosts outside expected engineering/HMI subnets, consistent with attempts to trigger the CVE-2026-0646 fault-and-disconnect condition via malformed CIP requests. Sustained high-rate connection attempts from a single source to these ports should be investigated as a potential DoS attempt; rate/volume thresholds should be tuned and monitored operationally rather than encoded here. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated CIP Protocol Requests to EtherNet/IP Adapter Management Port
id: e5535791-7d5a-5801-94be-d79b91123a1a
status: experimental
description: Detects network connections to CIP/EtherNet-IP ports (44818 TCP, 2222
UDP) used by Rockwell FLEX I/O adapters from source hosts not part of a defined
engineering/allowed asset list, indicating potential reconnaissance or exploitation
attempts targeting CVE-2026-0646 (CIP request DoS) or CVE-2026-0647 (auth bypass).
references:
- CISA advisory Rockwell FLEX I/O CVE-2026-0646 CVE-2026-0647
author: Vorant
tags:
- attack.t1498
- attack.impact
logsource:
category: network_connection
product: null
detection:
selection:
DestinationPort:
- 44818
- 2222
filter:
SourceIp|cidr:
- 10.0.0.0/8
- 192.168.0.0/16
- 172.16.0.0/12
condition: selection and not filter
falsepositives:
- Legitimate engineering workstation or SCADA/HMI polling traffic to the adapter that
originates from an untracked or newly added internal subnet
- Asset discovery/inventory scanning tools authorized for OT network scans
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-167-05
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free