# Rockwell Automation FLEX 5000 I/O denial-of-service flaws

Published: 2025-09-30 · Severity: routine · Sectors: manufacturing, energy, infrastructure, transportation, defense
Canonical: https://vorant.io/reports/e83bc77c-7b09-5afb-a647-c7263541b542/rockwell-automation-flex-5000-i-o-denial-of-service-flaws

> Two improper input validation flaws in Rockwell Automation FLEX 5000 I/O modules cause denial of service requiring power cycle; patch available.

Rockwell Automation has released an advisory for two improper input validation vulnerabilities affecting FLEX 5000 I/O modules (models 5094-IF8 and 5094-IY8) running version V2.011. Both vulnerabilities exist in the handling of CIP Class 32 requests when a module is inhibited. Exploitation causes the affected module to enter a fault state with the LED flashing red; upon un-inhibiting, the module returns a connection fault that persists until power cycle, resulting in denial of service. CVE-2025-9041 affects the 5094-IF8 and CVE-2025-9042 affects the 5094-IY8, both with CVSS v4 scores of 8.7 indicating remote exploitability with low attack complexity and no authentication required.

These devices are deployed across critical infrastructure sectors including chemical, manufacturing, energy, food and agriculture, transportation, and water systems worldwide. No active exploitation has been reported as of the advisory date. Rockwell Automation recommends upgrading to version V2.012 or later. CISA recommends isolating control system networks from the internet, placing devices behind firewalls, and using VPNs for required remote access.

## Mentioned in this report

- Vulnerabilities: CVE-2025-9041, CVE-2025-9042

## Detection guidance (public sample)

### Non-Engineering Process Connecting to EtherNet/IP CIP Port 44818

ATT&CK: T1499.001

Windows host process opening an outbound connection to TCP/UDP 44818 (EtherNet/IP explicit messaging, which carries CIP requests) from a binary outside Rockwell software directories, which may indicate crafted CIP traffic against I/O modules. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Non-Engineering Process Connecting to EtherNet/IP CIP Port 44818
id: 699e9caf-4930-5406-b479-b106cd5d2fba
status: experimental
description: Detects a Windows process opening an outbound connection to TCP/UDP 44818
  (EtherNet/IP explicit messaging, which carries CIP requests) from a binary outside
  Rockwell software directories. Crafted CIP Class 32 requests sent to inhibited FLEX
  5000 I/O modules can drive them into a persistent fault state (CVE-2025-9041, CVE-2025-9042).
  Tune by allow-listing known engineering and SCADA tooling.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-26
tags:
- attack.impact
- attack.t1499.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 44818
  filter_rockwell:
    Image|contains:
    - \Rockwell Software\
    - \Rockwell Automation\
    - \FactoryTalk
  condition: selection and not filter_rockwell
falsepositives:
- Third-party SCADA, historian or OPC gateway software polling controllers over EtherNet/IP
- Network asset discovery scanners run from Windows hosts in OT environments
level: medium
author: Vorant
```

### Internet Source Reaching EtherNet/IP Ports on Internal Devices

ATT&CK: T1499.001

Firewall log showing allowed traffic from a non-private source address to EtherNet/IP ports 44818 or 2222, exposing CIP devices such as FLEX 5000 I/O modules to unauthenticated remote DoS. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Internet Source Reaching EtherNet/IP Ports on Internal Devices
id: b6ce3eda-dc06-5d71-91c0-03bd67f9d9c0
status: experimental
description: Detects allowed firewall traffic from a non-private source to EtherNet/IP
  ports 44818 or 2222. FLEX 5000 I/O modules (5094-IF8, 5094-IY8) can be faulted by
  unauthenticated CIP Class 32 requests (CVE-2025-9041, CVE-2025-9042), so any externally
  reachable CIP service is high risk. Repeated hits from the same source over a short
  window strengthen the signal.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-26
tags:
- attack.impact
- attack.t1499.001
logsource:
  category: firewall
detection:
  selection:
    dst_port:
    - 44818
    - 2222
    action:
    - allowed
    - allow
    - accept
  filter_private_src:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and not filter_private_src
falsepositives:
- Authorised remote vendor support over a site-to-site path that presents public source
  addresses
- Internet-wide scanners reaching a permissive rule, which is itself a misconfiguration
  worth fixing
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-226-26

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e83bc77c-7b09-5afb-a647-c7263541b542/rockwell-automation-flex-5000-i-o-denial-of-service-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup