Rockwell Automation FLEX 5000 I/O denial-of-service flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two improper input validation flaws in Rockwell Automation FLEX 5000 I/O modules cause denial of service requiring power cycle; patch available.
Rockwell Automation has released an advisory for two improper input validation vulnerabilities affecting FLEX 5000 I/O modules (models 5094-IF8 and 5094-IY8) running version V2.011. Both vulnerabilities exist in the handling of CIP Class 32 requests when a module is inhibited. Exploitation causes the affected module to enter a fault state with the LED flashing red; upon un-inhibiting, the module returns a connection fault that persists until power cycle, resulting in denial of service. CVE-2025-9041 affects the 5094-IF8 and CVE-2025-9042 affects the 5094-IY8, both with CVSS v4 scores of 8.7 indicating remote exploitability with low attack complexity and no authentication required.
These devices are deployed across critical infrastructure sectors including chemical, manufacturing, energy, food and agriculture, transportation, and water systems worldwide. No active exploitation has been reported as of the advisory date. Rockwell Automation recommends upgrading to version V2.012 or later. CISA recommends isolating control system networks from the internet, placing devices behind firewalls, and using VPNs for required remote access.
Mentioned in this report
Detection guidance
Non-Engineering Process Connecting to EtherNet/IP CIP Port 44818
Windows host process opening an outbound connection to TCP/UDP 44818 (EtherNet/IP explicit messaging, which carries CIP requests) from a binary outside Rockwell software directories, which may indicate crafted CIP traffic against I/O modules. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Non-Engineering Process Connecting to EtherNet/IP CIP Port 44818
id: 699e9caf-4930-5406-b479-b106cd5d2fba
status: experimental
description: Detects a Windows process opening an outbound connection to TCP/UDP 44818
(EtherNet/IP explicit messaging, which carries CIP requests) from a binary outside
Rockwell software directories. Crafted CIP Class 32 requests sent to inhibited FLEX
5000 I/O modules can drive them into a persistent fault state (CVE-2025-9041, CVE-2025-9042).
Tune by allow-listing known engineering and SCADA tooling.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-26
tags:
- attack.impact
- attack.t1499.001
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 44818
filter_rockwell:
Image|contains:
- \Rockwell Software\
- \Rockwell Automation\
- \FactoryTalk
condition: selection and not filter_rockwell
falsepositives:
- Third-party SCADA, historian or OPC gateway software polling controllers over EtherNet/IP
- Network asset discovery scanners run from Windows hosts in OT environments
level: medium
author: Vorant
Internet Source Reaching EtherNet/IP Ports on Internal Devices
Firewall log showing allowed traffic from a non-private source address to EtherNet/IP ports 44818 or 2222, exposing CIP devices such as FLEX 5000 I/O modules to unauthenticated remote DoS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Internet Source Reaching EtherNet/IP Ports on Internal Devices
id: b6ce3eda-dc06-5d71-91c0-03bd67f9d9c0
status: experimental
description: Detects allowed firewall traffic from a non-private source to EtherNet/IP
ports 44818 or 2222. FLEX 5000 I/O modules (5094-IF8, 5094-IY8) can be faulted by
unauthenticated CIP Class 32 requests (CVE-2025-9041, CVE-2025-9042), so any externally
reachable CIP service is high risk. Repeated hits from the same source over a short
window strengthen the signal.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-26
tags:
- attack.impact
- attack.t1499.001
logsource:
category: firewall
detection:
selection:
dst_port:
- 44818
- 2222
action:
- allowed
- allow
- accept
filter_private_src:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_private_src
falsepositives:
- Authorised remote vendor support over a site-to-site path that presents public source
addresses
- Internet-wide scanners reaching a permissive rule, which is itself a misconfiguration
worth fixing
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-26
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs